{"uuid": "0ca54c31-591c-4d7f-9e4b-51ff2b18dc90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63376", "type": "seen", "source": "https://gist.github.com/alon710/e57ce4bf3882045270fbd4cafb0a7b39", "content": "# CVE-2026-63376: CVE-2026-63376: Prototype Pollution via Path Desynchronization in toml-node\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63376\n\n## Summary\nA prototype pollution vulnerability exists in the toml-node library (by BinaryMuse) in versions prior to 4.1.2. The flaw arises from inconsistent internal tracking of parsed paths (comma-joined vs. dot-joined serialization) combined with lack of object ownership validation during recursive dictionary descent (scalar descent). This allows unauthenticated remote attackers to modify base object structures by crafting malicious TOML documents containing conflicting duplicate table paths or nested references.\n\n## TL;DR\nImproper key verification and unrestricted recursive object traversal in toml-node's compiler logic allow remote attackers to poison Object.prototype via crafted TOML input, enabling prototype pollution.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 8.2 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not Listed\n- **EPSS Score**: 0.00383\n- **Impact Category**: Integrity (High), Availability (Low)\n\n## Affected Systems\n\n- Applications utilizing toml-node for parsing untrusted user configuration files\n- Node.js server-side platforms processing TOML structures under versions < 4.1.2\n- **toml-node**: < 4.1.2 (Fixed in: `4.1.2`)\n\n## Mitigation\n\n- Upgrade to toml-node v4.1.2 or higher\n- Launch NodeJS with the --disable-proto=delete CLI flag\n- Freeze Object.prototype using Object.freeze() at application startup\n- Implement structural validation or schema verification on incoming configuration payloads\n\n**Remediation Steps:**\n1. Execute the package manager update command: npm install toml-node@4.1.2\n2. Locate NodeJS execution scripts and append --disable-proto=delete to production execution environments\n3. Verify that dependencies do not rely on dynamic prototype additions that could break after freezing prototypes\n4. Deploy unit tests targeting recursive TOML structures to guarantee parsing libraries reject malicious inputs\n\n## References\n\n- [NVD Vulnerability Details: CVE-2026-63376](https://nvd.nist.gov/vuln/detail/CVE-2026-63376)\n- [CVE-2026-63376 Record at CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-63376)\n- [GHSA-v5mp-jgw5-2x6j GitHub Advisory](https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-v5mp-jgw5-2x6j)\n- [OSV / CVE Project Vulnerability Data JSON File](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63376.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63376) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T17:32:58.338683Z"}