CVE-2025-25975 Prototype Pollution Vulnerability in parse-git-config
An attacker can obtain sensitive information through the expandKeys function in the parse-git-config library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-25975?
CVE-2025-25975 is a high-severity vulnerability in n/a, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys function
Weakness: CWE-200
Which versions are affected by CVE-2025-25975?
2 open source packages ship an affected version, including parse-git-config. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parse-git-config npm | All versions to 3.0.0 | None |
parse-git-config npm | All versions to 3.0.0 | None |
Products include Jonschlinkert Parse-Git-Config.
How do I fix CVE-2025-25975?
Upgrade to a fixed version.
Is CVE-2025-25975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-25975 exists.
Sources
Also known as CLSA-2026-1774916743, GHSA-8g77-54rh-46hx.