CVE-2025-57347

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "__proto__"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.

• CWE-1321

• https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347Third Party Advisory
• https://github.com/tbo47/dagre-es/issues/52Issue Tracking

Published

Sep 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57327spmrc is a package that provides the rc manager for spm. A P…7.5
• CVE-2025-57328toggle-array is a package designed to enables a property on …7.5
• CVE-2025-57329web3-core-method is a package designed to creates the method…7.5
• CVE-2025-5733The Modern Events Calendar Lite plugin for WordPress is vuln…5.3
• CVE-2025-57330The web3-core-subscriptions is a package designed to manages…7.5
• CVE-2025-5734A vulnerability has been found in TOTOLINK X15 1.0.0-B202307…8.8
• CVE-2025-57348The node-cube package (prior to version 5.0.0) contains a vu…6.5
• CVE-2025-57349The messageformat package, an implementation of the Unicode …7.5
• CVE-2025-5735A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.11…8.8
• CVE-2025-57350The csvtojson package, a tool for converting CSV data to JSO…8.6
• CVE-2025-57351A prototype pollution vulnerability exists in the ts-fns pac…6.5
• CVE-2025-57352A vulnerability exists in the 'min-document' package prior t…5.3