PT-2025-33341 · @Std/Toml · @Std/Toml

Siunam321 · Published 2025-08-14 · Updated 2025-08-15 · CVE-2025-55195

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: @std/toml versions prior to 1.0.9

Description: Prior to version 1.0.9, the @std/toml library is susceptible to a Prototype Pollution (PP) vulnerability in Node.js runtime and Browser environments when parsing untrusted TOML data. This occurs because the library merges an untrusted object with an empty object that inherits from the prototype chain.

Recommendations: Update to version 1.0.9 or later.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-55195

GHSA-CRJP-8R9Q-2J9R

Affected Products

@Std/Toml

References · 9

• 🔥 https://github.com/denoland/std/security/advisories/GHSA-crjp-8r9q-2j9r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55195.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-55195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55195 · Security Note
• https://github.com/denoland/std/releases/tag/release-2025.08.13 · Note
• https://github.com/denoland/std/commit/540662cfd6d71e969af292aa604ef4049dbe271b · Note
• https://twitter.com/VulmonFeeds/status/1956120481750303128 · Twitter Post
• https://twitter.com/CVEnew/status/1956390314731573260 · Twitter Post
• https://t.me/CVEtracker/30017 · Telegram Post