GHSA-qqfj-vf92-g76jHighCVSS 8.2
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to...
🔗 CVE IDs covered (1)
📋 Description
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prototype key segments. Attackers can pass [proto] or [constructor.prototype] table headers or proto.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2021-48012
- https://github.com/Gin-Quin/fast-toml/issues/8
- https://github.com/Gin-Quin/fast-toml/pull/3
- https://github.com/Gin-Quin/fast-toml
- https://www.vulncheck.com/advisories/fast-toml-through-0.5.4-prototype-pollution-via-proto-keys-in-parsed-toml
- https://github.com/advisories/GHSA-qqfj-vf92-g76j