GHSA-f7f6-9jq7-3rqj
estree-util-value-to-estree allows prototype pollution in generated ESTree
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | estree-util-value-to-estree | < 3.3.3 | 3.3.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When generating an ESTree from a value with a property named `__proto__`, `valueToEstree` would generate an object that specifies a prototype instead.
Example:
```js
import { generate } from 'astring'
import { valueToEstree } from 'estree-util-value-to-estree'
const estree = valueToEstree({
['__proto__']: {}
})
const code = generate(estree)
console.log(code)
```
Output:
```js
{
"__proto__": {}
}
```
### Patches
This was fixed in version [3.3.3](https://github.com/remcohaszing/estree-util-value-to-estree/releases/tag/v3.3.3).
### Workarounds
If you control the input, don’t specify a property named `__proto__`. If you don’t control the output, strip any properties named `__proto__` before passing it to `valueToEstree`.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/remcohaszing/estree-util-value-to-estree/security/advisories/GHSA-f7f6-9jq7-3rqj
- https://nvd.nist.gov/vuln/detail/CVE-2025-32014
- https://github.com/remcohaszing/estree-util-value-to-estree/commit/d0c394fbc64bc55937ffe4e162b81f15ba506e55
- https://github.com/remcohaszing/estree-util-value-to-estree