CVE-2026-114142: fallo de gravedad alta en BinaryMuse toml-node
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.5%
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
BinaryMuse · toml-nodeCVEs relacionadas — BinaryMuse toml-node
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-63376HIGHtoml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path DesynchronizationEPSS 0.7%CVE-2026-77465HIGHtoml-node: Uncontrolled RecursionEPSS 0.6%CVE-2026-114143HIGHtoml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()EPSS 0.5%CVE-2026-114141HIGHtoml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()EPSS 0.5%CVE-2026-114144HIGHtoml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()EPSS 0.4%