PT-2026-120811 · Npm · Toml-Node
CVE-2026-114142
·
Published
2026-10-21
·
Updated
2026-10-21
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
toml-node versions prior to 5.0.1
Description
The
toml.parse() function allows writing attacker-controlled properties to Object.prototype. This occurs because the quoteDottedString() function in lib/compiler.js generates identical bookkeeping strings for different quoted key paths, which enables addTableArray() to clear the guard of another key. Consequently, the assign() path can traverse through an unowned Date value without performing the owned-container check, reaching the prototype chain and allowing other objects in the process to inherit the injected property.Recommendations
Update to version 5.0.1.
Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Toml-Node