High, CVSS 8.8npmAmendedPublished
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114142 · GHSA-h895-cgqg-jf52
- Affected
- npm tome <= 5.0.0
- Fixed in
- 5.0.1· Vendor fix available
- Issue
- CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries. Details Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0. 1. The path-key encoding is ambiguous. `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment: ```js 287: function quoteDottedString(str) { 288: if (str.indexOf(".") > -1) { 289: return "\"" + str + "\""; 290: } else { 291: return str; 292: } 293: } ``` So the key path `['x.y']` and the key path…
Recommended action: Upgrade to 5.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.