toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

PT-2026-85360

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

PT-2026-85247

Name of the Vulnerable Software and Affected Versions toml-node versions prior to 4.1.2 Description the toml.parse function in lib/compiler.js allows an attacker to write arbitrary keys onto Object.prototype by routing a table path through a scalar value. This occurs because the deepRef function...