Prototype Pollution Vulnerability in Expand-Object by Snyk

CVE-2025-3197

What is CVE-2025-3197?

Certain versions of the expand-object package contain a vulnerability in the expand() function located in index.js, which allows for prototype pollution. This issue arises as it enables an attacker to manipulate the prototype of an object by injecting properties through unvalidated inputs. Specifically, the function fails to verify the keys of the provided string, permitting modifications to sensitive properties like proto. This could lead to unexpected behavior in applications utilizing this package.

References