CVE-2025-3197: expand-object Vulnerable to Prototype Pollution via the expand() Function

April 4, 2025

Versions of the package expand-object from 0.0.0 to 0.4.2 are vulnerable to Prototype Pollution in the expand() function in index.js. This function expands the given string into an object and allows a nested property to be set without checking the provided keys for sensitive properties like proto.

References

gist.github.com/miguelafmonteiro/d8f66af61d14e06338b688f90c4dfa7c
github.com/advisories/GHSA-4vjr-hfpp-2m7w
github.com/jonschlinkert/expand-object
github.com/jonschlinkert/expand-object/blob/master/index.js
nvd.nist.gov/vuln/detail/CVE-2025-3197
security.snyk.io/vuln/SNYK-JS-EXPANDOBJECT-5821390

Code Behaviors & Features

Detect and mitigate CVE-2025-3197 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →