CVE-2025-32014
CVE-2025-32014 · estree-util-value-to-estree allows prototype pollution in generated ESTree
This page contains facts from public vulnerability sources. Check the original advisory before updating.
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.
CVSS 6.9 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
estree-util-value-to-estree
- Versions
- < 3.3.3: Affected
No fix published
estree-util-value-to-estree npm
- Affected ranges
- SEMVER: < 3.3.3
Update to 3.3.3