GHSA-4VJR-HFPP-2M7W expand-object Vulnerable to Prototype Pollution via the expand() Function

Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...

CVE-2025-3197

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto...

CVE-2025-3197

CVE-2025-3197 concerns the expand-object library. Reports across multiple sources confirm a Prototype Pollution flaw in the expand() function (index.js) that turns a string into an object without filtering keys like proto . Affected: expand-object versions 0.0.0 and later. Potential impact descri...

PT-2025-14841 · Unknown · Expand-Object

Name of the Vulnerable Software and Affected Versions: expand-object versions 0.0.0 and later Description: The issue concerns a Prototype Pollution flaw in the expand function located in index.js. This function is used to expand a given string into an object, but it does not check the provided ke...

expand-object 安全漏洞

expand-object is a library by Jon Schlinkert, a personal developer, that uses simple symbols to expand strings into JavaScript objects. A security vulnerability exists in expand-object that stems from prototype contamination in the expand function...

PT-2026-2895

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained an issue in the mm/page alloc component where the migration type of page blocks was not consistently updated during page coalescing. Specifically, when a page...

The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

...

Amazon Kindle e-reader输入验证错误漏洞

The Amazon Kindle e-reader is an e-reader by Amazon.com, Inc. A security vulnerability exists in Amazon Kindle e-reader version 5.13.4 and earlier, which stems from a heap-based buffer overflow in the function CJBig2Image::expand. The vulnerability can be exploited by an attacker to execute code...

Arbitrary Command Execution

mailx is vulnerable to arbitrary command execution. A remote attacker is able to execute arbitrary commands through the expand function in fio.c using shell metacharacters in a malicious email address...

PT-2017-7727 · Unrtf +1 · Unrtf +1

Name of the Vulnerable Software and Affected Versions: unrtf version 0.21.9 Description: The issue is caused by multiple stack-based buffer overflows that allow remote attackers to cause a denial-of-service. This can be achieved by writing a negative integer to the 1 cmd expand function, 2 cmd...

CVE-2004-2771

The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address...

DEBIAN-CVE-2012-6090

Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted filename...

UBUNTU-CVE-2012-6090

Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted filename...

libpng: buffer overwrite in png_rgb_to_gray

Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the pngrgbtogray function but not the pngsetexpand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and...

USN-154-1: vim vulnerability

Georgi Guninski discovered that it was possible to construct Vim modelines that execute arbitrary shell commands by wrapping them in glob or expand function calls. If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands...