CVE-2025-57347
Tbo47 Dagre-D3-Es 7.0.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-57347 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Tbo47 Dagre-D3-Es. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-57347 is a prototype pollution vulnerability in the 'dagre-d3-es' Node.js package, specifically within the 'bk' module's addConflict function. This flaw arises from the failure to properly sanitize user-supplied input during property assignment operations, enabling attackers to inject malicious values such as "__proto__" and modify the JavaScript Object prototype chain. The issue affects versions prior to 7.0.11.
Attackers can exploit this vulnerability remotely without authentication or user interaction, requiring only low complexity as reflected in its CVSS score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-1321. Exploitation allows unauthorized prototype chain modifications, potentially resulting in denial of service conditions, unexpected application behavior, or arbitrary code execution in contexts where polluted properties are later accessed or executed.
Published on 2025-09-24, the vulnerability remains unpatched at the time of disclosure. Key references include a proof-of-concept repository at https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57347 and a related GitHub issue at https://github.com/tbo47/dagre-es/issues/52, which discuss the flaw and may outline mitigation strategies.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31068
Vulnerability Data
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConflict function, which fails to properly sanitize user-supplied input during property assignment operations. This flaw allows attackers to exploit prototype pollution vulnerabilities by injecting malicious…
more
input values (e.g., "__proto__"), enabling unauthorized modification of the JavaScript Object prototype chain. Successful exploitation could lead to denial of service conditions, unexpected application behavior, or potential execution of arbitrary code in contexts where polluted properties are later accessed or executed. The issue affects versions prior to 7.0.11 and remains unpatched at the time of disclosure.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.