Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-50029— js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Quick assessment

Affected
sunnyadn js-toml
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sunny Yang js-toml是Sunny Yang个人开发者的一款TOML格式解析的开发框架。 Sunny Yang js-toml 1.1.2之前版本存在处理逻辑错误漏洞，该漏洞源于使用 而非 检查重复键，导致假值被覆盖，可能造成结构类型混淆，使依赖真值判断的主机应用被静默欺骗。

CVSS 5.3 · Medium EPSS 0.23% · P14

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
sunnyadn js-toml < 1.1.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-50029

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
js-toml has silent type confusion via falsy-primitive duplicate-key bypass
Source: CVE Program / CVE List V5
Vulnerability Description
js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `""` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec ("Defining a key multiple times is invalid"; "You cannot define any key or table more than once"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的比较
Source: CVE Program / CVE List V5
Vulnerability Title
Sunny Yang js-toml 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Sunny Yang js-toml是Sunny Yang个人开发者的一款TOML格式解析的开发框架。 Sunny Yang js-toml 1.1.2之前版本存在处理逻辑错误漏洞，该漏洞源于使用`if(object[key])`而非`if(key in object)`检查重复键，导致假值被覆盖，可能造成结构类型混淆，使依赖真值判断的主机应用被静默欺骗。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
sunnyadn js-toml < 1.1.2 -

II. Public POCs for CVE-2026-50029

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-50029

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-50029 (1)

Vendor Advisories for CVE-2026-50029 (1)

Other References for CVE-2026-50029 (1)

IV. Related Vulnerabilities

Same product: js-toml
Same vendor: sunnyadn
Same weakness: CWE-697

V. Comments for CVE-2026-50029

No comments yet

Leave a comment