CVE-2025-32014: estree-util-value-to-estree allows prototype pollution in generated ESTree

(updated )

When generating an ESTree from a value with a property named __proto__, valueToEstree would generate an object that specifies a prototype instead.

Example:

import { generate } from 'astring'
import { valueToEstree } from 'estree-util-value-to-estree'

const estree = valueToEstree({
['__proto__']: {}
})
const code = generate(estree)
console.log(code)

Output:

{
"__proto__": {}
}

References

Code Behaviors & Features

Detect and mitigate CVE-2025-32014 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →