Executive brief
smol-toml is a lightweight TOML parser library used by JavaScript applications to read configuration files. An attacker can craft a malicious TOML document with deeply nested inline tables to trigger a stack overflow, causing the application to crash and become unavailable.
Technical details
The vulnerability is an uncontrolled recursion issue (CWE-674) in the TOML parser. When parsing or stringifying deeply nested inline table structures, the library does not limit recursion depth, leading to a stack overflow that terminates the process. The attack is network-accessible and requires no authentication or user interaction—an attacker can send the malicious TOML directly to any application that parses arbitrary TOML input. The parser will crash if the application does not catch exceptions. Version 1.3.1 introduces a depth limit (default 1000) to make the behavior controlled and documented; earlier versions are affected.
Affected products
- squirrelchat smol-toml <= 1.3.0
Timeline
- 2024-11-22: disclosed
- 2024-11-18: patched: Version 1.3.1 released with depth limit enforcement