EUVD-2025-31068

Malicious code in bioql PyPI...

Prototype Pollution

Overview org.webjars.npm:dagre-d3-es is a a href="https://www.npmjs.com/dagre- Affected versions of this package are vulnerable to Prototype Pollution via the addConflict function in the bk module. An attacker can modify the JavaScript Object prototype chain by injecting malicious input values,...

CVE-2025-57347

CVE-2025-57347 affects the Node.js package dagre-d3-es (v7.0.9 affected; patched in newer releases). The vulnerability resides in the bk module’s addConflict() where user input is not properly sanitized during property assignment, enabling prototype pollution via inputs like proto . This can poll...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...