CVE-2021-48012

A flaw of important severity was found in fast-toml, a JavaScript/Node.js TOML parsing library distributed through the npm ecosystem. fast-toml through version 0.5.4 improperly controls modification of dynamically-determined object attributes: when an application parses untrusted TOML input, a remote attacker can supply crafted TOML containing proto, constructor, or prototype key segments (for example [proto] or [constructor.prototype] table headers, or proto.x dotted keys) to the parse() function and modify Object.prototype. Because the polluted prototype is inherited by all JavaScript objects in the process, successful exploitation can alter application behavior, potentially allowing the attacker to bypass authorization controls or cause a denial of service. The Red Hat severity rating of IMPORTANT (CVSS 3.1 score 8.2, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is consistent with the upstream assessment. No Red Hat products are currently listed as affected by this flaw; fast-toml is an upstream npm component and no affected Red Hat product relationship is recorded at this time.