toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

影響: npm:tome <= 5.0.0 → 5.0.1

CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — includ…

在 GitHub Advisory Database 阅读

2026/10/23 01:39，GitHub Advisory Database 发布了“toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-114142。