Toml (<= 5.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/toml--5.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 06:44:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgtoml: Prototype pollution via ambiguous TOML key paths (CVE-2026-114142)https://feed.craftedsignal.io/briefs/2026-10-toml-node-prototype-pollution/Fri, 23 Oct 2026 06:44:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-toml-node-prototype-pollution/The toml package is vulnerable to prototype pollution, allowing unauthorized injection of properties into Object.prototype via maliciously crafted TOML documents.The toml package (up to and including version 5.0.0) is susceptible to prototype pollution. The vulnerability arises from ambiguous key-path encoding where quoteDottedString() fails to escape double quotes, leading to path desynchronization. Combined with a table-array header that can clear security guards and a lack of isOwnedContainer checks during the assign() descent, an attacker can traverse into an object's prototype chain. Successfully crafting a specific TOML document allows for the injection of arbitrary properties into Object.prototype, which then become visible to every object in the Node.js process.

]]>highadvisoryprototype-pollutionnodejs