toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

影響: npm:tome <= 5.0.0 → 5.0.1

CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…

GitHub Advisory Databaseで読む

2026/10/23 01:39、GitHub Advisory Databaseが「toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-114142。