toml-node EUVD-2026-107553

Exploitation requires that the application call toml.parse() on TOML content an attacker can influence, and specifically relies on crafted quoted dotted key paths combined with a table-array ([[a]]) declaration so that quoteDottedString()'s colliding bookkeeping string clears another key's owned-container guard and lets assign() descend through an unowned Date value into Object.prototype. The affected versions are all releases prior to 5.0.1. The key limiting factor is that the attacker must control the parsed TOML input: applications that only parse trusted, developer-authored configuration files are not realistically exploitable, whereas services parsing user-supplied or remotely-fetched TOML are directly exposed. No authentication or user interaction is required by the library itself (PR:N/UI:N).

This is a prototype pollution flaw (CWE-1321) in the toml-node parser scored 8.8 via the provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high integrity and availability impact (VI:H/VA:H) and no confidentiality impact (VC:N). The network attack vector and no-privilege/no-interaction metrics reflect that the vulnerability is reachable whenever an application feeds attacker-controlled TOML to toml.parse() - the 'network' framing is a proxy for untrusted input flowing into the library, not a listening service. No EPSS score, no CISA KEV listing, and no public POC were supplied; the only exploitation-relevant artifact is the upstream patch commit (609c873) and GHSA advisory, which confirm the defect and fix but do not demonstrate weaponization. Signals are therefore consistent but modest: the technical impact is real and the preconditions are low, yet there is no evidence of active or opportunistic exploitation. Realistic priority is moderate-to-high for any service that parses untrusted TOML, and low for applications that only parse trusted, developer-authored config files. EPSS/KEV data is absent and should be checked before final triage; treat exploitation likelihood as unconfirmed rather than low.

An application uses toml-node (<5.0.1) to parse TOML supplied by an untrusted source - for example a user-uploaded config, an API request body, or a plugin manifest. The attacker submits a TOML document with specially crafted quoted dotted keys that collide in the parser's bookkeeping, causing assign() to descend through an unowned Date value and reach Object.prototype, polluting it so that unrelated objects created later in the process inherit the injected property. No public exploit code was identified at time of analysis.