{"id":"EUVD-2026-58791","revision":null,"records":[{"revision":"43d0f2fe49d04f5d9c535c1a3cce11e7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50029","aliases":[],"title":"js-toml has silent type confusion via falsy-primitive duplicate-key bypass","description":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `\"\"` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec (\"Defining a key multiple times is invalid\"; \"You cannot define any key or table more than once\"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.","state":0,"publishedAt":"2026-08-14T19:08:54.941+00:00","modifiedAt":"2026-08-17T19:34:15.876+00:00","affected":[{"ecosystem":"Vendor product","name":"js-toml","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sunnyadn\",\n                    \"product\": \"js-toml\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.1.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6","https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50029","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50029","identifiers":["CVE-2026-50029"]},"retained":false,"historicalAffected":[]},{"revision":"f9c7843938f94153b8e165b2e8a8e6fa","observedAt":"2026-11-11T13:05:41.377+00:00","statement":{"source":"euvd","id":"EUVD-2026-58791","aliases":["CVE-2026-50029","GHSA-m34p-749j-x6m6"],"title":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primit…","description":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `\"\"` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec (\"Defining a key multiple times is invalid\"; \"You cannot define any key or table more than once\"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":null}],"references":["https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6","https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58791","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 14, 2026, 7:08:54 PM","dateUpdated":"Aug 17, 2026, 7:34:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58791","identifiers":["EUVD-2026-58791","CVE-2026-50029","GHSA-m34p-749j-x6m6"]},"retained":false,"historicalAffected":[]},{"revision":"79ad4f6890cc4e5185e26d394a650773","observedAt":"2026-10-25T12:17:38.331+00:00","statement":{"source":"nvd","id":"CVE-2026-50029","aliases":[],"title":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primit…","description":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `\"\"` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec (\"Defining a key multiple times is invalid\"; \"You cannot define any key or table more than once\"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.","state":0,"publishedAt":"2026-08-14T19:17:18.98+00:00","modifiedAt":"2026-09-18T20:09:01.757+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2","https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50029","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-697"],"productCriteria":[],"sourceDates":{"published":"2026-08-14T19:17:18.980","lastModified":"2026-09-18T20:09:01.757"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-50029","identifiers":["CVE-2026-50029"]},"retained":false,"historicalAffected":[]},{"revision":"7bdeb2fc834840b3b3fd3b5c92688e4d","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-m34p-749j-x6m6","aliases":["CVE-2026-50029"],"title":"js-toml has silent type confusion via falsy-primitive duplicate-key bypass","description":"### Summary\n\n`js-toml`'s interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `\"\"` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec (\"Defining a key multiple times is invalid\"; \"You cannot define any key or table more than once\"), this should be a parse error.\n\nThe result is **structural type confusion of attacker-named keys** in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch.\n\nThis is **distinct** from [GHSA-65fc-cr5f-v7r2](https://github.com/sunnyadn/js-toml/security/advisories/GHSA-65fc-cr5f-v7r2) (the 1.0.2 prototype-pollution fix). `Object.prototype` is **not** polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction.\n\n### Details\n\nTwo truthy checks are wrong:\n\n`src/load/interpreter.ts:214` — `Interpreter.tryCreatingObject`\n\n```js\nif (object[key]) {            // falsy primitives slip through\n    // duplicate-key logic\n} else {\n    object[key] = createSafeObject();   // silently overwrites the prior falsy value\n    ...\n}\n```\n\n`src/load/interpreter.ts:278` — `Interpreter.getOrCreateArray`\n\n```js\nif (object[first] && !Array.isArray(object[first])) {   // same flaw\n    throw new DuplicateKeyError();\n}\nobject[first] = object[first] || [];   // overwrites the prior falsy value\n```\n\nBoth should use the `in` operator. Containers are created via `Object.create(null)`, so `in` is unambiguous (no inherited keys to worry about).\n\nThe bug is reachable through every parent-walking interpreter path:\n\n- `assignValue` — dotted keys in `key = value`\n- `createTable` — `[stdTable]` headers\n- `getOrCreateArray` — `[[arrayOfTables]]` headers\n\n### PoC\n\n```toml\nisAdmin = false\n[isAdmin]\nforced = \"yes\"\n```\n\n```js\nimport { load } from 'js-toml';\n\nconst config = load(`\nisAdmin = false\n[isAdmin]\nforced = \"yes\"\n`);\n\nconsole.log(JSON.stringify(config));\n// {\"isAdmin\":{\"forced\":\"yes\"}}\n\nconsole.log(config.isAdmin ? 'BYPASS' : 'safe');\n// BYPASS\n\nif (config.isAdmin) {\n  // attacker reaches admin-only code\n}\n```\n\n### Impact\n\nSpec-violating input acceptance leading to structural type confusion. (CWE-697)\n\n### Suggested fix\n\nin `src/load/interpreter.ts`\n\n```diff\nexport class Interpreter extends BaseCstVisitor {\n     ignoreImplicitDeclared,\n     ignoreExplicitDeclared\n   ) {\n-    if (object[key]) {\n+    if (key in object) {\n       if (\n         !isPlainObject(object[key]) ||\n         (!ignoreExplicitDeclared &&\n```\n```diff\nexport class Interpreter extends BaseCstVisitor {\n       return this.getOrCreateArray(keys, object[first], idx + 1);\n     }\n\n-    if (object[first] && !Array.isArray(object[first])) {\n+    if (first in object && !Array.isArray(object[first])) {\n       throw new DuplicateKeyError();\n     }\n\n     object[first] = object[first] || [];\n```","state":0,"publishedAt":"2026-06-26T22:49:28+00:00","modifiedAt":"2026-07-21T17:30:26.096074+00:00","affected":[{"ecosystem":"npm","name":"js-toml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6","https://github.com/sunnyadn/js-toml/commit/e0504fa5d3dcde2d1d588c9001c24b7b700beeeb","https://github.com/sunnyadn/js-toml","https://github.com/sunnyadn/js-toml/releases/tag/v1.1.2"],"sourceUrl":"https://github.com/advisories/GHSA-m34p-749j-x6m6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m34p-749j-x6m6","identifiers":["GHSA-m34p-749j-x6m6","CVE-2026-50029"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6882289+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.688234+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-98121ba726768336a864ab5bced2f3860f36459d7555a27229b152c25d7e1f39","complete":true,"records":424942,"lastAttemptAt":"2026-11-13T03:16:36.8593016+00:00","lastSuccessAt":"2026-11-13T03:16:36.8357038+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.8593016+00:00","snapshotPublishedAt":"2026-11-13T02:30:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7f404f09616a40578b159775b5b66635","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T03:29:27.9813623+00:00","lastSuccessAt":"2026-11-13T03:29:27.977+00:00","error":"370 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T03:29:27.977+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13369,"expectedIdentifiers":13846,"failedIdentifiers":370},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6892892+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.6892894+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99b329e58ea7441eaabf9a9af1bb4458","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T03:19:48.7349646+00:00","lastSuccessAt":"2026-11-13T03:19:48.73+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:48.73+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T03:19:40.4671686+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4671686+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T03:16:36.9337406+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.9337406+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T03:19:40.4889465+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4889465+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11714c374501e9f6ac09cc4e36bc0b50c7521131f606050aeabd7887ba2c0080","complete":true,"records":231743,"lastAttemptAt":"2026-11-13T03:19:40.3437235+00:00","lastSuccessAt":"2026-11-13T03:19:38.55958+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.3437235+00:00","snapshotPublishedAt":"2026-11-13T02:48:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}