What is the CVSS score of EUVD-2026-70738?

EUVD-2026-70738 has a contested CVSS base score of 8.2 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of toml-node are affected by EUVD-2026-70738?

The toml npm package (versions below 4.1.2) contains a prototype pollution flaw exploitable with publicly disclosed code, allowing unauthenticated attackers to inject code through malformed TOML…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-70738?

Yes, a public proof-of-concept exploit is available for EUVD-2026-70738. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-70738?

Within 24 hours: Scan all Node.js applications for the toml package using npm audit, identifying all instances running versions below 4.1.2 including transitive dependencies. Within 7 days: Prioritize testing toml version 4.1.2 upgrades in staging environments for production systems handling user-supplied configuration or authentication workflows. Within 30 days: Deploy toml version 4.1.2 across all production applications and validate patching through automated dependency scanning.

toml-node EUVD-2026-70738

| CVE-2026-63376 HIGH

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-09-03 GitHub_M

GHSA-v5mp-jgw5-2x6j

RCE Denial Of Service Node.js Red Hat Prototype Pollution Suse Toml Node

High

Disputed · 8.2 Vendor: GitHub_M

Severity by source

Sources disagree (Low–High)

Vendor (GitHub_M) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Network vector applies wherever application exposes TOML parsing to untrusted input; no auth or interaction required; C:N as prototype pollution has no direct confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

3.7 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

POC Analysis Generated

Sep 04, 2026 - 19:25 vuln.today

Patch available

Sep 03, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Sep 03, 2026 - 21:03 vuln.today

Analysis Generated

Sep 03, 2026 - 21:03 vuln.today

CVE Published

Sep 03, 2026 - 20:34 cve.org

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on toml (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.1.2.

DescriptionCVE.org

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2.

Articles & Coverage 1

News 3 New Node.js Vulnerabilities - 3 High Severity, 1 With POC Sep 04, 2026

AnalysisAI

Prototype pollution in toml-node (npm package toml by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to toml.parse(). The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing __proto__ traversal through scalar values into the real JavaScript prototype chain. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that attacker-controlled TOML content be passed to `toml.parse()`. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is broadly consistent with the vulnerability's mechanics: the network vector applies wherever an application accepts TOML from untrusted sources, and the high integrity impact reflects the ability to overwrite Object.prototype methods and properties. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to toml version 4.1.2 or later, which resolves the path desynchronization by converting internal path tracking to a consistent array representation, introducing an `ownedContainers` WeakSet that rejects prototype traversal into containers not created by the compiler, and fixing the `addTableArray` prefix-clear logic to use exact sub-path matching. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Scan all Node.js applications for the toml package using npm audit, identifying all instances running versions below 4.1.2 including transitive dependencies. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all

CVE-2024-41713 CRITICAL Emergency POC

9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could

CVE-2024-55591 CRITICAL Emergency POC

9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote

CVE-2023-44487 HIGH Act Now POC

7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

CVE-2014-7205 CRITICAL Act Now POC

10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t

CVE-2025-59528 CRITICAL Act Now POC

10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete

CVE-2017-14849 HIGH Act Now POC

7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc

CVE-2017-5941 CRITICAL Emergency POC

9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner

CVE-2014-0224 HIGH Act Now POC

7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph

CVE-2014-3744 HIGH Act Now POC

7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi

CVE-2014-9566 HIGH Act Now POC

7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin

CVE-2013-4660 MEDIUM This Month POC

6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic

CVE-2016-2107 MEDIUM This Month POC

5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all

CVE-2026-34621 HIGH POC

8.6

CVE-2024-56059 CRITICAL

9.8

CVE-2020-28271 CRITICAL POC

9.8

CVE-2023-38894 CRITICAL POC

9.8

CVE-2024-24292 CRITICAL POC

9.8

CVE-2023-26121 CRITICAL POC

10.0

CVE-2021-23449 CRITICAL POC

10.0

CVE-2024-39011 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected

EUVD-2026-70738 vulnerability details – vuln.today

Back

toml-node EUVD-2026-70738

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Node.js

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code