Executive brief
estree-util-value-to-estree is a JavaScript library that converts values into abstract syntax tree (AST) representations used by code generators. The library fails to properly validate object properties when processing input containing __proto__, allowing attackers to inject prototype pollution—a technique that modifies shared object prototypes and can affect all subsequent objects in the application.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the valueToEstree function. When processing objects with a __proto__ property, the function generates ESTree that treats __proto__ as a regular property instead of filtering or escaping it, allowing prototype pollution to occur in the generated code. The attack requires no authentication and is reachable over the network if the library is exposed through a web service; exploitation occurs by passing an object with a __proto__ property to valueToEstree. An attacker can modify object prototypes and potentially affect application behavior, though impact is limited by how the generated AST is used downstream. The vulnerability was fixed in version 3.3.3.
Affected products
- Remco Haszing estree-util-value-to-estree before 3.3.3
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: version 3.3.3