Description
js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `""` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You cannot define any key or table more than once"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.
Published: 2026-08-14
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The parser uses a falsy‑based existence check that skips duplicate key handling when the first value is a falsy primitive. An attacker can supply data that overwrites a previously defined false, 0, or empty string entry with an object, turning a boolean flag meant to deny certain actions into a truthy value. This structural type confusion violates the TOML specification, which requires duplicate keys to be flagged as an error, and enables unintended behavior such as bypassing user bans, deleting content, or enabling public mode.

Affected Systems

sunnyadn:js-toml versions prior to 1.1.2, including the 1.x release series.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires control over the TOML input that the application parses; when configuration files are sourced from an untrusted origin this could occur remotely. The most likely attack vector is through configuration or data files processed by the parser, and the impact is confined to the application’s logic that evaluates the manipulated flag. No denial‑of‑service or code‑execution outcomes are documented.

Generated by OpenCVE AI on August 14, 2026 at 20:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade js‑toml to version 1.1.2 or later, where the duplicate‑key comparison has been corrected.
  • Configure the parser or validation layer to reject duplicate keys or validate parsed configuration against a strict schema that disallows falsy primitives for flags controlling sensitive behavior.
  • Audit all existing configuration files or data inputs for duplicate keys that rely on falsy primitives and refactor them to use explicit boolean values instead of numbers or empty strings.

Generated by OpenCVE AI on August 14, 2026 at 20:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-m34p-749j-x6m6 js-toml has silent type confusion via falsy-primitive duplicate-key bypass
History

Fri, 14 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Sunnyadn
Sunnyadn js-toml
Vendors & Products Sunnyadn
Sunnyadn js-toml

Fri, 14 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Description js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `""` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You cannot define any key or table more than once"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.
Title js-toml has silent type confusion via falsy-primitive duplicate-key bypass
Weaknesses CWE-697
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Sunnyadn Js-toml
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-14T19:08:54.941Z

Reserved: 2026-06-02T22:46:02.580Z

Link: CVE-2026-50029

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T19:17:18.980

Modified: 2026-08-14T19:17:18.980

Link: CVE-2026-50029

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T20:45:03Z

Weaknesses