CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803 js-toml is vulnerable to Prototype Pollution

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

CVE-2025-54803

CVE-2025-54803 affects the JavaScript TOML parser js-toml . Vulnerable versions are those below 1.0.2 , where parsing a specially crafted TOML input can enable a prototype pollution attack that allows an attacker to add or modify properties on the global Object.prototype . The impact can range fr...

js-toml 安全漏洞

js-toml is a TOML parser for JavaScript by Sunny Personal Developer. A security vulnerability exists in versions of js-toml prior to 1.0.2, which stems from a prototype contamination vulnerability that could lead to modification of the global Object.prototype property...

CVE-2025-54803: Improperly Controlled Modification of Object Prototype Attributes

js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...

js-toml Prototype Pollution Vulnerability

A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...

barrelly (>=1.0.0, <=1.2.0) potentially affected by CVE-2025-54803 via js-toml (1.0.0)

js-toml NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on js-toml and may be impacted: - barrelly =1.0.0, =1.2.0 Source cves: CVE-2025-54803 Source advisory: OSV:GHSA-65FC-CR5F-V7R2...

GHSA-65FC-CR5F-V7R2 js-toml Prototype Pollution Vulnerability

A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...

PT-2025-31886

Name of the Vulnerable Software and Affected Versions js-toml versions prior to 1.0.2 Description A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This can lead to severe...

CVE-2025-32800 Conda-build vulnerable to supply chain attack vector due to pyproject.toml referring to dependencies not present in PyPI

Conda-build contains commands and tools to build conda packages. Prior to version 25.3.0, the pyproject.toml lists conda-index as a Python dependency. This package is not published in PyPI. An attacker could claim this namespace and upload arbitrary malicious code to the package, and then exploit...

CVE-2021-25946

Prototype pollution vulnerability in nconf-toml versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

Security update for cloud-regionsrv-client, python-toml

This update for cloud-regionsrv-client, python-toml contains the following fixes: cloud-regionsrv-client: - Update to 10.3.11 bsc1234050 + Send registration code for the extensions, not only base product Update to 10.3.9: bsc1234050 Send registration code for the extensions, not only base product...

SUSE-SU-2025:20224-1 Security update for cloud-regionsrv-client, python-toml

This update for cloud-regionsrv-client, python-toml contains the following fixes: cloud-regionsrv-client: - Update to 10.3.11 bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.9: bsc1234050 + Send registration code for the extensions, not only base...

PT-2025-54886

This update for cloud-regionsrv-client, python-toml contains the following fixes: cloud-regionsrv-client: - Update to 10.3.11 bsc1234050 + Send registration code for the extensions, not only base product - Update to 10.3.9: bsc1234050 + Send registration code for the extensions, not only base...

Stack Overflow

TOML parser is vulnerable to stack overflow. The vulnerability is due to improper handling of deeply nested structures in the TOML parser, which can lead to a stack overflow when encountering deeply nested inline structures or stringifying deeply nested objects. It allows an attacker to craft a...

UBUNTU-CVE-2024-8237

A Denial of Service DoS issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file...

@alexlit/config-markdownlint (2.8.0), @cluenar/tools (>=1.0.0, <=2.0.1) +58 more potentially affected by unknown CVE via smol-toml (>=1.1.2, <=1.3.0)

smol-toml NPM version =1.1.2, =1.0.0, =3.0.0, =4.2.1-alpha.1, =0.0.0, =1.1.0, =0.2.7, =0.0.1, =1.0.10, =7.6.4-next.39, =7.6.4-next.39, =7.6.4-next.39, =7.6.4-next.39, =9.0.0-canary.257 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PQHP-25J4-6HQ9...

smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables

Summary An attacker can send a maliciously crafted TOML to cause the parser to crash because of a stack overflow caused by a deeply nested inline structure. A similar problem occurs when attempting to stringify deeply nested objects. The library does not limit the maximum exploration depth while...