Vulnerability in npm (CVE-2025-63703)
Summary
vulnerability in npm (CVE-2025-63703). Successful exploitation can lead to full system takeover.
Original description
The description as published by the source.
npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
A flaw has been discovered in version 1.0.6 of the npm package 'parse-ini,' where attackers could execute malicious code affecting other programs. This critical issue arises from the ability to manipulate the package through specific configuration files, potentially causing unwanted programs or data leaks. Companies are urged to immediately discontinue use of this version and update to a secure version as soon as it becomes available.
The vulnerability manifests as Prototype Pollution in parse-ini's index.js(), where improper prototype modifications are possible. Attackers can exploit this via malicious .ini files to pollute the global object prototypes, potentially executing arbitrary code. The affected version is up to 1.0.6. Specifically, an ini file with a [proto] section triggers this issue due to lack of proper checks. As a workaround, strictly validate ini file input or apply a provided patch when available.
Prototype Pollution in npm package parse-ini's index.js().
In index.js() method of parse-ini version 1.0.6.
Critical, allowing potential code execution and denial of service.
Patch or upgrade to a fixed version when available, meanwhile validate ini inputs.
Validate .ini file inputs to prevent malicious entries.
Monitor for usage of global.proto in application logs.
Related past incidents Similar incidents extracted from past CVEs
Similar Prototype Pollution issue in lodash package, allowing property modification.
Prototype Pollution in yargs-parser affecting object prototype pollution.
Deep Merge utility users faced Prototype Pollution vulnerability leading to arbitrary code execution.
If this happens at your company Expected impact per business scenario
攻撃者がシステム全体にわたって悪意あるプロパティを展開し、予期しない動作を引き起こす可能性がある。
セキュリティが脆弱な状態でパッケージが他のプロジェクトで再利用され、連鎖的に影響を拡大する可能性がある。
攻撃者がクラウドリソースを悪用し、サービス拒否アタックを仕掛けることが可能となる。
現行のparse-iniパッケージの使用を停止し、セキュリティ更新が行われ次第、すぐに適用する。
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
Audit SBOM/dependencies for affected components.依存マニフェストで影響コンポーネントを特定する。
-
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- web gist.github.com
- web npmjs.com
- web github.com