PT-2025-14841 · Unknown · Expand-Object

Miguel Monteiro · CVE-2025-3197 · Published 2025-04-04 · Updated 2025-04-09

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions expand-object versions 0.0.0 and later

Description The issue concerns a Prototype Pollution flaw in the expand() function located in index.js. This function is used to expand a given string into an object, but it does not check the provided keys for sensitive properties like proto, allowing a nested property to be set. This can be exploited by attackers.

Recommendations For versions 0.0.0 and later of expand-object, consider disabling the expand() function in index.js until a patch is available to prevent potential exploitation. Restrict access to sensitive properties like proto to minimize the risk of Prototype Pollution.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-3197

GHSA-4VJR-HFPP-2M7W

Affected Products

Expand-Object

References · 12

• 🔥 https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3197 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vjr-hfpp-2m7w · Vendor Advisory
• https://github.com/jonschlinkert/expand-object/blob/master/index.js%23L13 · Note
• https://github.com/jonschlinkert/expand-object · Note
• https://github.com/jonschlinkert/expand-object/blob/master/index.js#L13 · Note
• https://t.me/cvedetector/22072 · Telegram Post
• https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c · Note
• https://twitter.com/CVEnew/status/1908072018018287625 · Twitter Post
• https://twitter.com/SecurtyRating/status/1908032130803736597 · Twitter Post
• https://twitter.com/cracbot/status/1909924354223198518 · Twitter Post