Executive brief
js-toml is a library used to parse TOML configuration files. A flaw in how it handles duplicate keys allows an attacker to bypass security checks by overwriting configuration values. For example, an attacker could change a 'false' security flag to a 'true' object, potentially gaining unauthorized access to administrative features or bypassing banned user restrictions.
Technical details
The js-toml interpreter contains a logic error in its duplicate-key detection state machine. It uses truthy checks (e.g., `if (object[key])`) instead of the `in` operator to verify if a key has already been defined. When a key is initially assigned a 'falsy' primitive value (such as `false`, `0`, or `""`), the check fails, allowing the key to be silently overwritten by a subsequent sub-table or array-of-tables. This results in structural type confusion where a boolean or numeric value is replaced by a truthy object. This vulnerability is reachable via dotted keys, standard table headers, and array-of-tables headers. The issue is fixed in version 1.1.2.
Affected products
- sunnyadn js-toml <= 1.1.1
Timeline
- 2026-05-28: disclosed
- 2026-06-26: advisory: GitHub Advisory published
References
- https://api.github.com/users/CosmicCrusader23
- https://github.com/CosmicCrusader23
- https://api.github.com/users/CosmicCrusader23/gists%7B/gist_id%7D
- https://api.github.com/users/CosmicCrusader23/repos
- https://avatars.githubusercontent.com/u/217740635?v=4
- https://api.github.com/users/CosmicCrusader23/events%7B/privacy%7D