IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-04-07 15:15

MODIFIED

2025-04-08 18:14

EPSS (Prob. Exploit)

0.45%

Top 62.1%

DATA SOURCES:

NVD 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-03-01

> DESCRIPTION

estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-f7f6-9jq7-3rqj MODERATE

estree-util-value-to-estree allows prototype pollution in generated ESTree

AFFECTED PACKAGES:

NPM / estree-util-value-to-estree

< 3.3.3

Fixed in: 3.3.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

estree-util-value-to-estree allows prototype pollution in generated ESTree

AFFECTED PACKAGES:

Unknown / Unknown

16 versions affected

ALIASES:

GHSA-f7f6-9jq7-3rqj

> HISTORIQUE DES MODIFICATIONS

Première apparition

07/04/2025 15:15

Source: NVD

📊 ENRICHISSEMENT 18/10/2025 15:02

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui