GHSA-f7f6-9jq7-3rqj

Source

https://github.com/advisories/GHSA-f7f6-9jq7-3rqj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-f7f6-9jq7-3rqj/GHSA-f7f6-9jq7-3rqj.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f7f6-9jq7-3rqj

Aliases

CVE-2025-32014

Downstream

MINI-2mgx-9rqc-rhm5

Published

2025-04-07T19:09:48Z

Modified

2025-04-07T19:57:11Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

estree-util-value-to-estree allows prototype pollution in generated ESTree

Details

Impact

When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead.

Example:

import { generate } from 'astring'
import { valueToEstree } from 'estree-util-value-to-estree'

const estree = valueToEstree({
  ['__proto__']: {}
})
const code = generate(estree)
console.log(code)

Output:

{
  "__proto__": {}
}

Patches

This was fixed in version 3.3.3.

Workarounds

If you control the input, don’t specify a property named __proto__. If you don’t control the output, strip any properties named __proto__ before passing it to valueToEstree.

Database specific

{
    "cwe_ids":  [
        "CWE-1321"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-07T19:09:48Z",
    "nvd_published_at":  "2025-04-07T15:15:44Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / estree-util-value-to-estree

Package

Name: estree-util-value-to-estree; View open source insights on deps.dev
Purl: pkg:npm/estree-util-value-to-estree

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.3.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-f7f6-9jq7-3rqj/GHSA-f7f6-9jq7-3rqj.json"