Detections
Analytics

SCA: security update for js-toml (GHSA-m34p-749j-x6m6)

medium Tenable Cloud Security Plugin ID 444047

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key
 already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When
 the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `""` — the duplicate-key branch
 is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-
 tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You
 cannot define any key or table more than once"), this should be a parse error. The result is structural
 type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or
 numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if
 (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy
 branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype`
 is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the
 duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect
 comparison. (CVE-2026-50029)

Solution

Update the js-toml library and its related packages to version 1.1.2 or later.

See Also

https://github.com/advisories/GHSA-m34p-749j-x6m6

Plugin Details

Severity: Medium

ID: 444047

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/27/2026

Updated: 8/18/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-50029

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/26/2026

Vulnerability Publication Date: 6/26/2026

Reference Information

CVE: CVE-2026-50029

cwe: CWE-697