Open-source package vulnerability · npm
CVE-2025-63703: parse-ini is vulnerable to Prototype Pollution in index.js()
criticalCVSS 3.1 9.8GHSA-x72j-hv9f-qqh4
npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().
Published May 7, 2026 · Updated May 12, 2026
Affected packages
parse-ini
- Ecosystem
- npm
- Affected
- = 1.0.6
- Fixed in
- No patched version yet
- Check
npm ls parse-ini
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology