fkie_cve-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.

GHSA-h895-cgqg-jf52 — toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Affected: npm: tome

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.

A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.

### Details Three gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.

**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `"` inside the segment:

```js 287: function quoteDottedString(str) { 288: if (str.indexOf(".") > -1) { 289: return "\"" + str + "\""; 290: } else { 291: return str; 292: } 293: } ```

So the key path `['x.y']` and the key path `['"x', 'y"']` both render as the string `"x.y"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.

**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.

**3. The descent in `assign()` has no owned-container check.** `deepRef(…

Most recent entries from all

fkie_cve-2026-114142

GHSA-h895-cgqg-jf52 — toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype