CVE-2026-63376: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in BinaryMuse toml-node

The vulnerability exists in toml-node's parsing logic where the currentPath tracking uses inconsistent formats (arrays and strings) leading to a duplicate-key guard bypass. An attacker can craft table paths such as a.b.y.__proto__.__proto__ to traverse and modify Number.prototype and Object.prototype. Additionally, a table-array prefix-clearing path can erase guard state, allowing prototype pollution. Injected properties affect the entire Node.js process, enabling various impacts including denial of service and potential code execution. The vulnerability is addressed in toml-node version 4.1.2.

Exploitation of this vulnerability allows an attacker to inject or modify properties on Object.prototype, which can lead to denial of service, logic or authorization bypass, or arbitrary code execution if the application uses vulnerable gadgets. The impact is limited to applications using vulnerable versions of toml-node prior to 4.1.2.

A fix is available in toml-node version 4.1.2. Users should upgrade to version 4.1.2 or later to remediate this vulnerability. No other mitigation guidance is provided by the vendor advisory.