{"id":"ghsa-ghsa-h895-cgqg-jf52","seq":309565,"kind":"advisory","title":"toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype","url":"https://github.com/advisories/GHSA-h895-cgqg-jf52","permalink":"https://vulnpulse.app/items/ghsa-ghsa-h895-cgqg-jf52","summary":"影響: npm:tome <= 5.0.0 → 5.0.1\nCVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-114142"],"tags":["GHSA-h895-cgqg-jf52","tome"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:39:55.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}