The toml-node library contains a critical prototype pollution vulnerability that allows unauthenticated remote attackers to manipulate object prototypes and potentially achieve arbitrary code execution.

This is a prototype pollution vulnerability (CWE-1321) occurring in the toml.parse function. An unauthenticated attacker can supply a specially crafted TOML table path to overwrite properties in the global Object.prototype, which affects the entire Node.js process.

The ability to pollute the object prototype is a high-severity risk as it can alter the behavior of the application at runtime. Depending on the presence of specific gadgets in the application, this vulnerability may lead to complete system compromise, unauthorized data access, or denial of service. Given the CVSS score of 8.2, this vulnerability represents a significant threat to application integrity and availability.

Immediate Action: Update the toml-node dependency to version 4.1.2 or later immediately to incorporate the necessary prototype protection logic.

Proactive Monitoring: Monitor application logs for unusual object property assignments or unexpected errors during the parsing of TOML configuration files.

Compensating Controls: If immediate patching is not feasible, implement strict input validation to sanitize TOML input and reject any payloads containing keywords such as proto, constructor, or prototype.

Public Exploit Available: Unknown

This vulnerability poses a substantial risk to any application relying on toml-node for configuration or data parsing. Organizations should prioritize upgrading to version 4.1.2 across all development and production environments to eliminate the risk of prototype pollution. Failure to patch may expose the application to sophisticated injection attacks that bypass standard security controls.