CVE-2025-55195 Details
Description
@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9.
A prototype pollution vulnerability has been identified in the Deno Standard Library package @std/toml, affecting versions through 1.0.8. The issue arises when the library parses untrusted TOML data, allowing an attacker to manipulate the prototype chain in Node.js and browser environments. This vulnerability occurs because the library merges an untrusted object with a default empty object, which carries a prototype chain. The flaw has been addressed in version 1.0.9.
Users can update to @std/toml version 1.0.9 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 14, 2025CISA-ADP
Assessed Aug 14, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/denoland/std/security/advisories/GHSA-crjp-8r9q-2j9r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/denoland/std/commit/540662cfd6d71e969af292aa604ef4049dbe271b | [email protected] | Source CodeVendor |
| https://github.com/denoland/std/releases/tag/release-2025.08.13 | [email protected] | Release NotesVendor |
| https://github.com/denoland/std/security/advisories/GHSA-crjp-8r9q-2j9r | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| denoland/std/toml | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 14, 2025 | CVE Modified | CISA-ADP |
| Aug 14, 2025 | New CVE Received | [email protected] |