CVE-2025-32014 — estree-util-value-to-estree allows prototype pollution in generated ESTree
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would gene…
Published: 2025-04-07 · CVSS: 6.9 · CVSS 4.0
estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead. This vulnerability is fixed in 3.3.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7