dagre-d3-es up to 7.0.9 prototype pollution

Summaryinfo

A vulnerability was found in dagre-d3-es up to 7.0.9. It has been classified as critical. The affected element is an unknown function. This manipulation causes prototype pollution. This vulnerability is handled as CVE-2025-57347. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in dagre-d3-es up to 7.0.9. It has been declared as critical. Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious input values (e.g., "__proto__"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-57347 since 08/17/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Upgrading to version 7.0.11 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-31068). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• dagre-d3-es

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion