toml-node EUVD-2026-70738

Exploitation requires that attacker-controlled TOML content be passed to toml.parse(). Applications that parse TOML only from internal, trusted sources (bundled configuration files, developer-authored configs read at startup) are not directly exposed. Applications that accept TOML from user input - file uploads, API request bodies, environment-variable-derived paths, or any externally supplied string - are directly exploitable with no authentication (PR:N), no special network position beyond reaching the application endpoint (AV:N), and no user interaction beyond the application's normal TOML ingestion workflow (UI:N). The severity of downstream impact (DoS vs. logic bypass vs. RCE) is application-specific and depends on the presence of a prototype-pollution gadget chain in the target Node.js process; exploitation to simple prototype modification is guaranteed, but escalation to code execution requires a suitable gadget. Both the comma-desynchronization bypass and the table-array prefix-clear bypass are independently exploitable with minimal TOML payloads as demonstrated in the public advisory PoC.

The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) is broadly consistent with the vulnerability's mechanics: the network vector applies wherever an application accepts TOML from untrusted sources, and the high integrity impact reflects the ability to overwrite Object.prototype methods and properties. However, actual exploitability is gated on whether the application exposes a TOML ingestion path to untrusted input - internal or developer-only TOML parsing is not directly affected. No CISA KEV listing is present at time of analysis, and EPSS data was not provided in available intelligence. The GHSA advisory includes functional PoC code demonstrating Object.prototype modification with a two-line TOML payload, lowering the bar for exploitation significantly. Real-world impact escalates substantially if the Node.js process contains gadget chains conditioned on prototype-inherited properties - template engines, authorization middleware, and child_process wrappers are common candidates in the Node.js ecosystem. Even a mid-sized municipal IT team in gdynia running a Node.js configuration management service that ingests TOML from user submissions should treat this as urgent patching work, given that the PoC is public and prototype pollution RCE gadget chains are well-documented across the ecosystem. The scope-unchanged (S:U) rating is appropriate because pollution is contained to the same Node.js process, but that process boundary typically encompasses security-critical middleware, making the I:H rating well-founded.

An attacker submits a TOML configuration document to a Node.js web application that uses toml.parse() to process user-supplied configuration data. The document contains a path such as [a.b.y.__proto__.__proto__] with key-value pairs after first establishing a.b.y = 1; the parser's desynchronized guard fails to detect the scalar-traversal bypass and writes the attacker's keys directly onto Object.prototype. If the application's authorization middleware or template engine inherits from Object.prototype, the injected property overrides expected behavior - enabling privilege escalation or, with a suitable gadget such as a toString/hasOwnProperty override or a child_process call conditioned on an inherited property, arbitrary code execution within the Node.js process.