CVE-2025-57328

Vulnerability

Overview

The toggle-array package (versions 1.0.1 and earlier) contains a Prototype Pollution vulnerability in the enable and disable functions. The vulnerability allows an attacker to inject arbitrary properties onto Object.prototype by supplying a specially crafted payload [1][3]. This is classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') [3].

Attack

Vector

The attack is performed by passing a malicious payload to the enable or disable functions. The package's design enables or disables a property on objects at a specified index, but insufficient input validation allows the attacker to manipulate the prototype chain. No authentication is required, and the attack can be executed remotely if the application processes user-controlled input through these functions [1][2].

Impact

Successful exploitation results in Prototype Pollution, which can cause denial of service (DoS) as the minimum consequence. Depending on the application's logic, the attacker may also achieve property injection that affects all objects in the runtime, potentially leading to more severe outcomes such as arbitrary code execution or data manipulation [1][3].

Mitigation

As of the publication date, no patch has been released for toggle-array. Users should avoid using the package with untrusted input or consider replacing it with an alternative that properly sanitizes input. The vulnerability is tracked in public proof-of-concept repositories [3].