fast-toml versions up to 0.5.4 are vulnerable to prototype pollution because the parser accepts TOML tables or keys that contain __proto__, constructor, or prototype. By supplying such keys, an attacker can modify Object.prototype and thereby alter the behavior of all JavaScript objects in the process. This enables denial of service or authorization bypass scenarios if the polluted prototype is later used in application logic.

The vulnerability affects the fast-toml package provided by the Gin-Quin project, specifically any deployment using version 0.5.4 or earlier.

The CVSS score of 8.8 marks this flaw as high risk. Although an EPSS score is not available, the flaw remains exposed in the wild and is not currently listed in CISA’s KEV catalog. Attackers can exploit it by supplying crafted TOML input to the parse() function, which is typically invoked on user data. Successful exploitation leads to uncontrolled manipulation of JavaScript prototypes, rendering the application vulnerable to denial of service or elevated privileges.