7 matches found
CVE-2025-32014
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...
@clevercanyon/dev-deps (>=1.0.277, <=1.0.411), @veryfront/remark-plugins (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-32014 via estree-util-value-to-estree (>=3.0.1, <=3.3.2)
estree-util-value-to-estree NPM version =3.0.1, =1.0.277, =0.0.1, =0.0.0-1785108, =0.39.3 Source cves: CVE-2025-32014 Source advisory: OSV:GHSA-F7F6-9JQ7-3RQJ...
CVE-2025-32014
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...
CVE-2025-32014 estree-util-value-to-estree allows prototype pollution in generated ESTree
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...
CVE-2025-32014 estree-util-value-to-estree allows prototype pollution in generated ESTree
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...
CVE-2025-32014
CVE-2025-32014 affects estree-util-value-to-estree. When valueToEstree processes an object with a proto property, the generated ESTree could pollute prototypes; this is fixed in version 3.3.3. Remediation is to upgrade to 3.3.3+ or apply the provided workaround (avoid/strip proto properties). In ...
CVE-2025-32014 estree-util-value-to-estree allows prototype pollution in generated ESTree
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...