{"id":"CVE-2021-48012","revision":"62e0ac85f4614b8d8fd68842b9443970","records":[{"revision":"62e0ac85f4614b8d8fd68842b9443970","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-48012","aliases":[],"title":"fast-toml through 0.5.4 Prototype Pollution via __proto__ Keys in Parsed TOML","description":"fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.","state":0,"publishedAt":"2026-10-12T20:55:05.966+00:00","modifiedAt":"2026-10-12T20:55:05.966+00:00","affected":[{"ecosystem":"Vendor product","name":"fast-toml","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gin-Quin\",\n                    \"product\": \"fast-toml\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.5.4\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/fast-toml\",\n                    \"repo\": \"https://github.com/Gin-Quin/fast-toml\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.8,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","score":8.2,"severity":"HIGH"}],"references":["https://github.com/Gin-Quin/fast-toml/issues/8","https://github.com/Gin-Quin/fast-toml/pull/3","https://github.com/Gin-Quin/fast-toml","https://www.vulncheck.com/advisories/fast-toml-through-0.5.4-prototype-pollution-via-proto-keys-in-parsed-toml"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-48012","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-48012","identifiers":["CVE-2021-48012"]},"retained":false,"historicalAffected":[]}],"coverage":[]}