CVE-2021-48012High· 8.2▾ Twilightfast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [const…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prototype key segments. Attackers can pass [proto] or [constructor.prototype] table headers or proto.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-78181High· 7.3A weakness has been identified in ractivejs ractive up to 1.4.4
CVE-2026-78179Medium· 6.3A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17
CVE-2026-78180High· 7.3A security flaw has been discovered in alibaba-fusion next up to 1.27.34
CVE-2021-23450High· 7.5All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
CVE-2021-23383Medium· 5.6The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
CVE-2020-7788High· 7.3This affects the package ini before 1.3.6