A prototype pollution vulnerability in the Deno Standard Library @std/toml affects applications using versions prior to 1.0.9, creating a risk of remote code execution or application instability.

The library incorrectly merges untrusted objects into empty objects, which allows an unauthenticated attacker to pollute the prototype chain. This flaw occurs during the parsing of malicious TOML data within Node.js or browser runtimes.

Prototype pollution can lead to significant security consequences, including cross-site scripting (XSS), denial of service, or remote code execution depending on how the application uses the modified objects. With a CVSS score of 7.3, this high-severity vulnerability poses a substantial risk to service integrity and data confidentiality, particularly for applications processing external user-supplied data.

Immediate Action: Update the @std/toml library to version 1.0.9 or later immediately to incorporate the necessary prototype protection logic.

Proactive Monitoring: Monitor application logs for unusual object property behaviors or unexpected runtime errors that may indicate attempts to manipulate the prototype chain.

Compensating Controls: Implement strict input validation and sanitization for all TOML data before passing it to the library, and utilize object freezing or null-prototype objects where possible to prevent prototype modification.

Public Exploit Available: Unknown

Given the potential for severe impact and the existence of a proof-of-concept, organizations must prioritize upgrading their dependencies. Applying the 1.0.9 patch is the only effective way to remediate this flaw and prevent attackers from leveraging prototype pollution to compromise application logic.