EUVD-2025-209729
GHSA-x72j-hv9f-qqh4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only when an app feeds untrusted INI to the parser and a gadget exists, so AC:H; integrity/availability high via pollution, confidentiality only low as direct data disclosure is not inherent.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().
AnalysisAI
Prototype pollution in the npm package parse-ini v1.0.6 lets remote attackers inject properties onto Object.prototype through crafted INI input parsed by index.js, potentially corrupting application state, enabling denial of service, or escalating to remote code execution in downstream Node.js applications. The flaw carries a CVSS 9.8 rating with total technical impact and is flagged automatable by CISA's SSVC, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis beyond a reference gist. parse-ini is an obscure, low-adoption library, so real-world exposure is narrow despite the critical score.
Technical ContextAI
parse-ini is a small Node.js library that parses INI-format configuration text into JavaScript objects. The vulnerability is CWE-1321, Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'): when the parser walks INI keys such as section or nested names, it recursively assigns properties without sanitizing special keys like '__proto__', 'constructor', or 'prototype'. As a result, attacker-controlled INI content can reach and mutate Object.prototype, so every object in the running Node.js process inherits the injected property. Depending on how the host application later reads those polluted properties, this can distort logic, bypass checks, cause crashes, or - if a polluted property flows into a gadget such as a template engine or child_process option - reach arbitrary code execution. The affected code is identified only as index.js() of parse-ini version 1.0.6, per the MITRE/NVD record.
RemediationAI
No vendor-released patch identified at time of analysis - the references (a GitHub gist at https://gist.github.com/6en6ar/bdc8e0d472406ab98431f10273cbdbf3 and the npm package page https://www.npmjs.com/package/parse-ini?activeTab=code) point to disclosure material and source, not a fixed release, and no fixed version number is stated in the data. Given the package's obscurity and low maintenance signal, the most reliable remediation is to remove parse-ini 1.0.6 from the dependency tree and migrate to a well-maintained, prototype-pollution-hardened INI parser (for example a parser that drops '__proto__'/'constructor' keys). If the dependency must remain, compensating controls include: never passing untrusted or user-supplied INI content to parse-ini (restrict it to trusted local config only, which eliminates the network attack path); sanitizing input to strip '__proto__', 'constructor', and 'prototype' keys before parsing; and hardening the process by freezing Object.prototype (Object.freeze(Object.prototype)), noting the side effect that code relying on later prototype mutation will break. Monitor https://nvd.nist.gov/vuln/detail/CVE-2025-63703 for a patched version.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today