What’s Vulnerable › Vulnerabilities

CVE-2025-3197

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-04 · updated 2026-06-17
• Weakness: CWE-1321

Description

Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like __proto__.

Affected products

• expand-object: all versions

References

• https://gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c
• https://github.com/jonschlinkert/expand-object/blob/master/index.js%23L13
• https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390
• https://security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390

Get alerted when CVE-2025-3197 or the next vulnerability affects your stack