Executive brief
The parse-ini library, used for reading configuration files in Node.js applications, contains a security flaw that allows attackers to inject malicious data into the application's core memory. By providing a specially crafted .ini file, an attacker can modify global object properties, potentially leading to application crashes or unauthorized code execution. This could allow an attacker to take control of the server or disrupt business operations.
Technical details
A prototype pollution vulnerability exists in the parse-ini npm package (v1.0.6) within the index.js file. The parser fails to validate or sanitize keys such as '__proto__' when processing .ini files, specifically at lines 101 and 104. An attacker can exploit this by providing a malicious .ini file containing a '[__proto__]' section, which allows them to inject arbitrary properties into the global Object prototype. This can lead to Denial of Service (DoS) or Remote Code Execution (RCE) depending on how the application uses the polluted objects. No patch is currently available.
Affected products
- npm parse-ini 1.0.6
Timeline
- 2026-05-06: disclosed: Public disclosure via GitHub Gist
- 2026-05-07: advisory: GitHub Advisory published