CVE-2025-25975
📋 TL;DR
A vulnerability in parse-git-config v3.0.0 allows attackers to read sensitive information from git configuration files through improper handling in the expandKeys function. This affects applications using this library to parse git configurations, potentially exposing credentials and repository metadata. Developers using parse-git-config in their projects are primarily impacted.
💻 Affected Systems
- parse-git-config
📦 What is this software?
Parse Git Config by Jonschlinkert
⚠️ Risk & Real-World Impact
Worst Case
Attackers could extract git credentials, SSH keys, API tokens, and other sensitive configuration data stored in git config files, leading to unauthorized repository access and potential lateral movement.
Likely Case
Exposure of repository URLs, user emails, and other git configuration details that could facilitate social engineering or targeted attacks.
If Mitigated
Limited exposure of non-sensitive configuration data with proper input validation and access controls in place.
🎯 Exploit Status
Exploitation requires the application to process attacker-controlled git configuration files through the vulnerable library.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.0.1 or later
Vendor Advisory: https://github.com/jonschlinkert/parse-git-config/issues/14
Restart Required: No
Instructions:
1. Update parse-git-config dependency to version 3.0.1 or later. 2. Run 'npm update parse-git-config' or update package.json to '^3.0.1'. 3. Rebuild and redeploy your application.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize git configuration files before passing to parse-git-config library
Restrict File Access
allLimit access to git configuration files and ensure they come from trusted sources only
🧯 If You Can't Patch
- Implement strict input validation for git configuration files
- Monitor for suspicious access patterns to git configuration data
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for parse-git-config version 3.0.0Check Version:
npm list parse-git-configVerify Fix Applied:
Verify parse-git-config version is 3.0.1 or higher in package.json📡 Detection & Monitoring
Log Indicators:
- Unexpected access to git configuration files
- Multiple failed parsing attempts of git config
Network Indicators:
- Unusual git operations from unexpected sources
SIEM Query:
source="application_logs" AND ("parse-git-config" OR "git config") AND error