Malicious code in estree-util (npm)

Source: amazon-inspector 137bbad3650384f516e11cd21a91087a3521948ed4f6c1952af26ebb739f5e54 The package estree-util was found to contain malicious code. --- Credit: OpenSSF source...

CLSA-2026-1784943105 TuxCare security update for estree-util-value-to-estree (1 CVE)

TuxCare rebuilt estree-util-value-to-estree to address 1 CVE. Fixed in 1.3.0-tuxcare.1...

PT-2026-75726

TuxCare rebuilt estree-util-value-to-estree to address 1 CVE. Fixed in 1.3.0-tuxcare.1...

MAL-2025-192796 Malicious code in estree-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 137bbad3650384f516e11cd21a91087a3521948ed4f6c1952af26ebb739f5e54 The package estree-util was found to contain malicious code...

Malicious code in estree-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 137bbad3650384f516e11cd21a91087a3521948ed4f6c1952af26ebb739f5e54 The package estree-util was found to contain malicious code...

CVE-2025-32014

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...

@clevercanyon/dev-deps (>=1.0.277, <=1.0.411), @veryfront/remark-plugins (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-32014 via estree-util-value-to-estree (>=3.0.1, <=3.3.2)

estree-util-value-to-estree NPM version =3.0.1, =1.0.277, =0.0.1, =0.0.0-1785108, =0.39.3 Source cves: CVE-2025-32014 Source advisory: GHSA-F7F6-9JQ7-3RQJ...

GHSA-F7F6-9JQ7-3RQJ estree-util-value-to-estree allows prototype pollution in generated ESTree

Impact When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. Example: js import generate from 'astring' import valueToEstree from 'estree-util-value-to-estree' const estree = valueToEstree 'proto': const code...

@clevercanyon/dev-deps (>=1.0.277, <=1.0.411), @veryfront/remark-plugins (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2025-32014 via estree-util-value-to-estree (>=3.0.1, <=3.3.2)

estree-util-value-to-estree NPM version =3.0.1, =1.0.277, =0.0.1, =0.0.0-1785108, =0.39.3 Source cves: CVE-2025-32014 Source advisory: OSV:GHSA-F7F6-9JQ7-3RQJ...

CVE-2025-32014

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...

@active-mdx/core (>=0.2.0, <=0.9.6), @allenlee/remark-mdx-frontmatter (3.1.2) +291 more potentially affected by CVE-2025-32014 via estree-util-value-to-estree (>=1.3.0, <=3.3.2)

estree-util-value-to-estree NPM version =1.3.0, =0.2.0, =0.0.1-alpha.1, =0.1.0-RC.0, =0.0.1, =0.0.6, =0.0.0-rc-20220721064837, =0.1.3, =0.1.3, =0.1.3, =0.1.3, =0.9.1, =1.0.0 and more Source cves: CVE-2025-32014 Source advisory: MEND:CVE-2025-32014...

CVE-2025-32014

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...

CVE-2025-32014 estree-util-value-to-estree allows prototype pollution in generated ESTree

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...

CVE-2025-32014

CVE-2025-32014 affects estree-util-value-to-estree. When valueToEstree processes an object with a proto property, the generated ESTree could pollute prototypes; this is fixed in version 3.3.3. Remediation is to upgrade to 3.3.3+ or apply the provided workaround (avoid/strip proto properties). In ...

CVE-2025-32014: Improperly Controlled Modification of Object Prototype Attributes

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named proto, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3...

PT-2025-15241 · Unknown · Estree-Util-Value-To-Estree

Name of the Vulnerable Software and Affected Versions: estree-util-value-to-estree versions prior to 3.3.3 Description: The issue arises when estree-util-value-to-estree converts a JavaScript value to an ESTree expression. Specifically, when generating an ESTree from a value with a property named...

estree-util-value-to-estree security vulnerability

estree-util-value-to-estree is a tool for converting JavaScript values to estree expressions by the individual developer Remco Haszing. A security vulnerability exists in estree-util-value-to-estree that stems from improper handling of the proto attribute, which could lead to prototype...