CVE-2025-63704 identifies a Prototype Pollution vulnerability in the query-parser-string NPM package version 1.0.0. The issue arises from improper sanitization of user input in query parameters, which are merged into a new object without validation. This flaw allows an attacker to manipulate the prototype of base objects, potentially leading to arbitrary code execution or denial of service. The vulnerability is remotely exploitable without authentication and requires no user interaction, resulting in a critical risk level. No official patch or remediation level has been published as of the current data.

Successful exploitation of this vulnerability could allow an attacker to alter the prototype of JavaScript objects, leading to arbitrary code execution, data corruption, or denial of service. The CVSS score of 9.8 reflects a critical impact on confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider avoiding use of the affected package version or implement input validation and sanitization controls in their own code to mitigate prototype pollution risks.