CVE-2026-114142 ยท GHSA-h895-cgqg-jf52
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
- Risk score
- 67/100
- CVSS
- 8.8 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A prototype pollution vulnerability in toml-node allows an attacker to write to Object.prototype when parsing a TOML document, potentially leading to objects created elsewhere in the process inheriting the injected property.
- Affected
- {'products': ['toml-node'], 'packages': ['tome'], 'versions': ['<= 5.0.0']}
- Fix
- Upgrade to version 5.0.1 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| tome | npm | <= 5.0.0 | 5.0.1 |
References
- https://github.com/advisories/GHSA-h895-cgqg-jf52
- https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-h895-cgqg-jf52
- https://nvd.nist.gov/vuln/detail/CVE-2026-114142
- https://github.com/BinaryMuse/toml-node/commit/609c873fffea0a27ebe5b4dd098eed2b3daf3606
- https://github.com/BinaryMuse/toml-node/releases/tag/v5.0.1
- https://github.com/advisories/GHSA-h895-cgqg-jf52
Original description
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in lib/compiler.js produces the same bookkeeping string for distinct quoted key paths, allowing addTableArray() to clear another key's guard. The assign() path then descends through an unowned Date value without applying the owned-container check and can reach the prototype chain. Objects created elsewhere in the process can inherit the injected property. This issue is fixed in version 5.0.1.
Last activity 21 Oct 2026. Patch Forecast updates every hour.