PT-2025-31886 · Js-Toml · Js-Toml
Siunam321
·
Publicado
2025-08-03
·
Atualizado
2025-10-09
·
CVE-2025-54803
CVSS v4.0
7.9
Alta
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H |
Name of the Vulnerable Software and Affected Versions
js-toml versions prior to 1.0.2
Description
A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global
Object.prototype by parsing a maliciously crafted TOML input. This can lead to severe security vulnerabilities in applications that use the library, potentially including authentication bypass, Denial of Service (DoS), or Remote Code Execution (RCE), depending on the application's logic and dependencies. The vulnerability occurs when parsing a TOML string containing the specially crafted key proto.Recommendations
Upgrade to version 1.0.2 or later to mitigate this issue.
Ensure that any TOML input being passed to the js-toml library is from a fully trusted source and has been validated to not contain malicious keys.
Exploit
Correção
RCE
Prototype Pollution
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Js-Toml