Prototype Pollution in Remcohaszing Estree-Util-Value-To-Estree

CVE-2025-32014

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.

Vulnerability class: Prototype Pollution

EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.

Affected products

Remcohaszing Estree-util-value-to-estree — versions < 3.3.3

Weakness classification (CWE)

CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)