CVE-2025-3197: High severity expand-object vulnerability
Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.
Other sources
Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3197?
CVE-2025-3197 is considered to have a high severity due to its potential for Prototype Pollution vulnerabilities.
How do I fix CVE-2025-3197?
To fix CVE-2025-3197, update the expand-object package to a version that is higher than 0.0.0.
What does CVE-2025-3197 affect?
CVE-2025-3197 affects versions of the expand-object package starting from 0.0.0.
What is Prototype Pollution in CVE-2025-3197?
Prototype Pollution in CVE-2025-3197 allows an attacker to manipulate an object's prototype, leading to security vulnerabilities.
How is the expand() function related to CVE-2025-3197?
The expand() function in CVE-2025-3197 expands strings into objects without properly validating keys, which can allow sensitive properties to be set.