Is CVE-2025-54803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-54803 being exploited in the wild.

How severe is CVE-2025-54803?

Medium severity, with a CVSS score of 4, published 4 August 2025.

Which products and versions are affected?

js-toml (npm) SEMVER:introduced=0,fixed=1.0.2.

Is there a fix for CVE-2025-54803?

Yes. js-toml (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-54803 attacked?

It is attacked over the network.

Am I affected by CVE-2025-54803?

Check whether you run js-toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-54803: js-toml prototype pollution via malicious TOML

CVE-2025-54803 · Severity: medium · CVSS 4 · Published 2025-08-04

js-toml is a JavaScript library used to parse TOML configuration files. A prototype pollution vulnerability allows attackers to inject malicious TOML input that modifies global object properties, potentially leading to authentication bypasses, denial of service, or remote code execution in applications using the library to parse untrusted data.

Technologies: js-toml (npm). Vendors: npm.

Quick answers

Is CVE-2025-54803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-54803 being exploited in the wild.
How severe is CVE-2025-54803?: Medium severity, with a CVSS score of 4, published 4 August 2025.
Which products and versions are affected?: js-toml (npm) SEMVER:introduced=0,fixed=1.0.2.
Is there a fix for CVE-2025-54803?: Yes. js-toml (npm): upgrade to 1.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54803 attacked?: It is attacked over the network.
Am I affected by CVE-2025-54803?: Check whether you run js-toml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

js-toml (npm): upgrade to 1.0.2 or later
```
npm install js-toml@1.0.2
```

Technical details

This vulnerability is a prototype pollution flaw (CWE-1321) in the js-toml TOML parser. When parsing TOML input containing the specially crafted key __proto__, the library incorrectly adds or modifies properties on the global Object.prototype. The vulnerability requires no authentication or user interaction and is triggered simply by parsing untrusted TOML input. While js-toml itself lacks vulnerable gadgets, attackers can exploit this in consuming applications—for example, bypassing authorization checks that test for properties like user.isAdmin. The patch is available in version 1.0.2; all prior versions are vulnerable.

Affected products

js-toml js-toml < 1.0.2

Identifiers

CVE-2025-54803
GHSA-65fc-cr5f-v7r2

Timeline

2025-08-04: disclosed: Advisory published
2025-08-04: patched: Patch released in version 1.0.2

References

https://github.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.