Prototype Pollution Vulnerability in parse-ini by npm

CVE-2025-63703

What is CVE-2025-63703?

The npm package parse-ini version 1.0.6 is susceptible to a prototype pollution vulnerability found in its index.js file. This vulnerability can allow an attacker to manipulate and inject properties into the object's prototype, potentially leading to unexpected behavior in applications that utilize the affected package. Developers relying on parse-ini for parsing configuration files should review their implementations and consider upgrading to a secure version to mitigate the risks associated with this vulnerability.

References