Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-54803

25
FAUCET Score

CVE-2025-54803 is a prototype pollution vulnerability affecting js-toml versions below 1.0.2, allowing remote attackers to modify global Object.prototype properties via malicious TOML input. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high integrity impact, but no confidentiality or availability impact. While the FAUCET Risk Score is 73/100, there is currently no evidence of active exploitation, public exploit code, or significant community discussion, suggesting a low immediate threat.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.0.2CPE matchmatch criteria
cpe:2.3:a:sunnyadn:js-toml:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 4.0

7.9HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
NONE
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
HIGH
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.50%
Probability of exploitation in next 30 days
EPSS Percentile
39.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0050 is in the 18th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: js-tomlFixed in: 1.0.2

Vendor Advisories (1)

npmGHSA-65fc-cr5f-v7r2high

js-toml Prototype Pollution Vulnerability

Aug 4, 2025

References

gist.github.com / siunam321/f3dc4d21a5a932c67b6c11d0026f5afc
Exploit
github.com / sunnyadn/js-toml/commit/b125910a3f094b744c9c3571360d4b9e3a472f66
Patch
github.com / sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2
Vendor Advisory