CVE-2025-55195CWE-1321

@std/toml Prototype Pollution in Node.js and Browser

High · published August 14, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
26.6
In the wild
Unconfirmed
What it is

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00343 · 26.6th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2025-08-14T16:39Z
EPSS history
Timeline
  • 14 AUG 16:39Z
    @std/toml Prototype Pollution in Node.js and Browser
    cvelistv5