CVE-2026-114142 BinaryMuse CVE debrief

Who should care

Defenders responsible for maintaining and securing systems that utilize the toml-node package should be aware of this vulnerability and take steps to verify and mitigate potential risks.

Why it matters

Defenders should be aware of this prototype pollution vulnerability in the toml-node package, verify affected versions, and upgrade to version 5.0.1 or later to mitigate potential risks.

• Potential for unintended property modifications to Object.prototype.
• Possible impact on system stability and security due to prototype pollution.
• Need for verification of affected versions and upgrading to a fixed version.
• Potential for attackers to exploit this vulnerability in specific contexts.

Technical summary

The toml-node package is vulnerable to prototype pollution when parsing a TOML document. This can occur due to ambiguous path-key encoding and a missing owned-container check. An attacker could potentially exploit this vulnerability to write properties onto Object.prototype, affecting every object in the process. The vulnerability arises from the package's inability to properly handle certain key paths, allowing an attacker to pollute the Object.prototype. This could lead to security issues, including unintended property modifications.

Defensive priority

Defenders should prioritize verifying the affected versions of the toml-node package and upgrading to version 5.0.1 or later.

Recommended defensive actions

• Verify the version of the toml-node package and upgrade to version 5.0.1 or later.
• Review and update affected systems and applications that use the toml-node package.
• Monitor for potential exploitation attempts and implement compensating controls if necessary.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by ambiguous path-key encoding and a missing owned-container check in the toml-node package. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the owned-container check is not applied on the path that matters. A four-line TOML document parsed with toml.parse() writes a property onto Object.prototype, where it is visible to every object in the process — including objects produced by unrelated libraries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.