PT-2025-31886 · Js-Toml · Js-Toml

Siunam321 · Published 2025-08-03 · Updated 2025-10-09 · CVE-2025-54803

Positive Technologies (AI Summary)

CVSS v4.0

7.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.0.2

Description A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This can lead to severe security vulnerabilities in applications that use the library, potentially including authentication bypass, Denial of Service (DoS), or Remote Code Execution (RCE), depending on the application's logic and dependencies. The vulnerability occurs when parsing a TOML string containing the specially crafted key proto.

Recommendations Upgrade to version 1.0.2 or later to mitigate this issue. Ensure that any TOML input being passed to the js-toml library is from a fully trusted source and has been validated to not contain malicious keys.

Exploit

Fix

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BDU:2026-07566

CVE-2025-54803

GHSA-65FC-CR5F-V7R2

Affected Products

Js-Toml

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54803.json · Exploit
• 🔥 https://gist.github.com/siunam321/f3dc4d21a5a932c67b6c11d0026f5afc · Exploit
• https://github.com/sunnyadn/js-toml/commit/b125910a3f094b744c9c3571360d4b9e3a472f66 · Patch
• https://github.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-65fc-cr5f-v7r2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54803 · Security Note
• https://bdu.fstec.ru/vul/2026-07566 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54803 · Vendor Advisory
• https://github.com/sunnyadn/js-toml · Note
• https://twitter.com/SecAideInfo/status/1953400022164439141 · Twitter Post
• https://twitter.com/CVEnew/status/1952539713908474199 · Twitter Post
• https://t.me/CVEtracker/29155 · Telegram Post
• https://t.me/cveNotify/138029 · Telegram Post