Prototype Pollution

Overview dagre-d3-es is a a href="https://www.npmjs.com/dagre- Affected versions of this package are vulnerable to Prototype Pollution via the addConflict function in the bk module. An attacker can modify the JavaScript Object prototype chain by injecting malicious input values, which may result ...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @7nohe/vite-plugin-vue-marked (0.2.1) +569 more potentially affected by CVE-2025-57347 via dagre-d3-es (>=7.0.4, <=7.0.11)

dagre-d3-es NPM version =7.0.4, =0.0.1-alpha.23, =0.18.0-beta.0, =0.3.0, =1.0.3, =0.17.0-alkemio-1, =0.4.0, =1.0.0, =3.130.1, =1.19.0, =1.0.0, =0.18.3, =0.18.0-1, =0.18.0 and more Source cves: CVE-2025-57347 Source advisory: SNYK:JS-DAGRED3ES-13110069...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

PT-2025-39322

Name of the Vulnerable Software and Affected Versions dagre-d3-es versions prior to 7.0.11 Description A flaw exists in the 'dagre-d3-es' Node.js package within the 'bk' module’s addConflict function. The issue stems from inadequate input sanitization during property assignment, allowing prototyp...

CVE-2025-57347

The dagre-d3-es Node.js package (versions prior to 7.0.11 ) is vulnerable to Prototype Pollution due to insufficient input sanitization in the bk module's addConflict function. Attackers can inject malicious values like __proto__ to modify the JavaScript Object prototype chain. This flaw could le...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

dagre-d3-es 安全漏洞

dagre-d3-es is a js library by Teebo Personal Developers. A security vulnerability exists in dagre-d3-es versions prior to 7.0.11, which stems from the addConflict function of the bk module not properly cleaning up user input, which could lead to a prototype contamination attack...

CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

CVE-2025-57347: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution...

Mermaid 安全漏洞

Mermaid is a mermaid-js open source application. Creates diagrams and visualizations using text and code. A security vulnerability exists in Mermaid 11.9.0 and earlier versions, which stems from user-entered architecture diagram icons being passed to the d3 html method, potentially leading to...

CVE-2025-54880: Improper Neutralization of Input During Web Page Generation

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html...

MAL-2025-13680 Malicious code in @zalastax/nolb-react-d3 (npm)

The package @zalastax/nolb-react-d3 was found to contain malicious code...

Malicious code in @gs-ux-uitoolkit-angular/d3-chart (npm)

The package @gs-ux-uitoolkit-angular/d3-chart was found to contain malicious code...

Malicious code in @zalastax/nolb-react-d3 (npm)

The package @zalastax/nolb-react-d3 was found to contain malicious code...

MAL-2025-17911 Malicious code in d3-brave-math (npm)

The package d3-brave-math was found to contain malicious code...

MAL-2025-16413 Malicious code in c-squared-system-d3 (npm)

The package c-squared-system-d3 was found to contain malicious code...

Malicious code in d3-brave-math (npm)

The package d3-brave-math was found to contain malicious code...

MAL-2025-7986 Malicious code in @gs-ux-uitoolkit-angular/d3-chart (npm)

The package @gs-ux-uitoolkit-angular/d3-chart was found to contain malicious code...

CVE-2025-23873

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anshi Solutions Category D3 Tree category-d3-tree allows Stored XSS.This issue affects Category D3 Tree: from n/a through = 1.1...