CVE-2025-55195 - CVE House
Back to Database
Status published High CVE-2025-55195

@std/toml Prototype Pollution in Node.js and Browser

Vulnerability Description

@std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55195

Credits & Attribution

No credits recorded in the NVD database.

References

More from denoland

View All →
CVE-2025-61787
Deno is Vulnerable to Command Injection on Windows During Batch File Execution
High 8.1
CVE-2025-61786
Deno's --deny-read check does not prevent permission bypass
Low 3.3
CVE-2025-61785
Deno's --deny-write check does not prevent permission bypass
Low 3.3
CVE-2025-48935
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
Medium 5.5
CVE-2025-48934
Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables
Medium 5.5

Affected Vendor

Affected Software

std
Vulnerable Versions:
< 1.0.9

Timeline

Official Publish: August 14th, 2025
Last Modified: August 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-1321

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.