Prototype Pollution Vulnerability in Expand-Object by Snyk

CVE-2025-3197

What is CVE-2025-3197?

Certain versions of the expand-object package contain a vulnerability in the expand() function located in index.js, which allows for prototype pollution. This issue arises as it enables an attacker to manipulate the prototype of an object by injecting properties through unvalidated inputs. Specifically, the function fails to verify the keys of the provided string, permitting modifications to sensitive properties like proto. This could lead to unexpected behavior in applications utilizing this package.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References