PT-2025-39322 · Npm · Dagre-D3-Es

Published 2025-09-24 · Updated 2025-10-17 · CVE-2025-57347

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dagre-d3-es versions prior to 7.0.11

Description A flaw exists in the 'dagre-d3-es' Node.js package within the 'bk' module’s addConflict() function. The issue stems from inadequate input sanitization during property assignment, allowing prototype pollution. Attackers can inject malicious input values, such as proto, to modify the JavaScript Object prototype chain. Successful exploitation may result in denial of service, unexpected application behavior, or arbitrary code execution when polluted properties are accessed or executed.

Recommendations Update to dagre-d3-es version 7.0.11 or later.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57347

Affected Products

Dagre-D3-Es

References · 8

• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-57347 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57347 · Vendor Advisory
• https://github.com/tbo47/dagre-es/issues/52 · Note
• https://t.me/CVEtracker/33285 · Telegram Post
• https://t.me/cveNotify/139152 · Telegram Post
• https://t.me/cveNotify/136626 · Telegram Post
• https://twitter.com/CVEnew/status/1970996101601022306 · Twitter Post