ByteOS Network

CVE Vulnerability Details :

CVE-2025-3197

PUBLISHED

More Info Official Page

Assigner-snyk

Assigner Org ID-bae035ff-b466-4ff4-94d0-fc9efd9e1730

Published At-04 Apr, 2025 | 05:00

Updated At-04 Apr, 2025 | 14:17

▼CVE Numbering Authority (CNA)

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.

Affected Products

Vendor

n/a

Product

expand-object

Versions

Affected

From 0.0.0 before * (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	Prototype Pollution

Metrics

Version	Base score	Base severity	Vector
3.1	7.3	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
4.0	6.9	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Credits

Miguel Monteiro

References

Hyperlink	Resource
https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390	N/A
https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c	N/A
https://github.com/jonschlinkert/expand-object/blob/master/index.js%23L13	N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-1321	CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Metrics Other Info

References

Hyperlink	Resource
https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390	exploit

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References