CVE-2025-3197
CVE-2025-3197
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.
CVSS 6.9 · Medium · EPSS 0.4%
- Published
- Updated
Stack: node
Affected products and versions
expand-object
- Versions
- ≥ 0.0.0: Affected (semver)
No fix published
expand-object npm
- Affected ranges
- SEMVER: ≤ 0.4.2
No fix published