CVE-2021-48012

{
  "etk_id": "ETK-2026-1438",
  "cve_id": "CVE-2021-48012",
  "display_id": "CVE-2021-48012",
  "ghsa_id": "GHSA-qqfj-vf92-g76j",
  "euvd_id": "EUVD-2021-34885",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Prototype pollution in fast-toml",
  "summary": "fast-toml versions through 0.5.4 can modify inherited JavaScript object properties when parsing untrusted TOML. An attacker who can supply TOML to the parser may cause denial of service or affect authorization decisions.",
  "mitigation": "Do not pass untrusted TOML to fast-toml, and reject inputs containing prototype-related property paths before parsing. Isolate parsing from security-sensitive object handling until a patched release is confirmed.",
  "vendor": "gin-quin",
  "product": "fast-toml",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.5.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "fast-toml",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
  "epss_score": 0.0041,
  "epss_percentile": 0.344,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.432305,
  "t0_at": "2026-10-12T20:55:05.966000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T20:55:05.966000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T20:55:05.966000+00:00",
      "url": "https://github.com/advisories/GHSA-qqfj-vf92-g76j"
    }
  }
}