The vulnerability exists in the toml-node library prior to version 5.0.1. When a TOML document is parsed, the internal quoteDottedString logic can produce an identical bookkeeping string for different quoted key paths. This allows addTableArray to clear a different key’s guard, and the subsequent assign path can descend through an unowned Date value without applying an owned‑container check. As a result, the parser can reach Object.prototype and write attacker‑controlled properties. Injected properties may then be inherited by objects created elsewhere in the application, potentially enabling arbitrary code execution or other malicious behavior.

BinaryMuse toml-node, versions prior to 5.0.1.

The CVSS score of 8.8 classifies this as high‑severity. An attacker can supply a malicious TOML document to any Node.js component that uses toml-node, causing prototype pollution. Although an EPSS score is not available, the lack of a KEV listing does not reduce the technical risk, especially for applications that import untrusted TOML data. The primary attack vector is local or internal, requiring only that the vulnerable library processes crafted input. Once the prototype is polluted, downstream libraries or code that rely on Object.prototype may behave unexpectedly, giving the attacker leverage to elevate privileges or tamper with application state.