CVE-2021-25946

Vulnerability

Prototype pollution vulnerability exists in nconf-toml versions 0.0.1 through 0.0.2 [1]. The plugin parses TOML files and merges the resulting object into the nconf configuration store without sanitizing keys. The vulnerable code is in index.js at line 8 [2], where properties are assigned directly from the parsed TOML object.

Exploitation

An attacker can craft a TOML file containing __proto__ or constructor.prototype keys. If an application using nconf-toml loads such a file (e.g., via nconf.file()), the malicious keys pollute the global Object.prototype. No authentication is required if the attacker can supply the file path or content.

Impact

Successful exploitation leads to denial of service (DoS) due to unexpected behavior from polluted prototypes, and may enable remote code execution (RCE) by overwriting properties used in subsequent code execution [1][4].

Mitigation

No official patch has been released for nconf-toml versions 0.0.1-0.0.2. Users should avoid processing untrusted TOML files with this library. Consider switching to alternative TOML parsers that are not vulnerable to prototype pollution. The repository [3] appears unmaintained.