{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/toml--5.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-114142"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["toml (\u003c= 5.0.0)"],"_cs_severities":["high"],"_cs_tags":["prototype-pollution","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe toml package (up to and including version 5.0.0) is susceptible to prototype pollution. The vulnerability arises from ambiguous key-path encoding where \u003ccode\u003equoteDottedString()\u003c/code\u003e fails to escape double quotes, leading to path desynchronization. Combined with a table-array header that can clear security guards and a lack of \u003ccode\u003eisOwnedContainer\u003c/code\u003e checks during the \u003ccode\u003eassign()\u003c/code\u003e descent, an attacker can traverse into an object's prototype chain. Successfully crafting a specific TOML document allows for the injection of arbitrary properties into \u003ccode\u003eObject.prototype\u003c/code\u003e, which then become visible to every object in the Node.js process.\u003c/p\u003e\n","date_modified":"2026-10-23T06:44:24Z","date_published":"2026-10-23T06:44:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-toml-node-prototype-pollution/","summary":"The toml package is vulnerable to prototype pollution, allowing unauthorized injection of properties into Object.prototype via maliciously crafted TOML documents.","title":"toml: Prototype pollution via ambiguous TOML key paths (CVE-2026-114142)","url":"https://feed.craftedsignal.io/briefs/2026-10-toml-node-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Toml (\u003c= 5.0.0)","version":"https://jsonfeed.org/version/1.1"}