{"answers":{"affected":"2 open source packages ship an affected version, including js-toml.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50029 exists.","fix":"Upgrade js-toml to 1.1.2 or later.","what":"CVE-2026-50029 is a medium-severity vulnerability in sunnyadn js-toml, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-50029 and fix it if it is affected.\n\nWhat it is: CVE-2026-50029 is a medium-severity vulnerability in sunnyadn js-toml, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50029 exists.\n\nAffected packages and fixed versions:\n- js-toml (npm): affected all versions; fixed in 1.1.2\n- js-toml (npm): affected all versions; fixed in 1.1.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-50029/ (Markdown: https://insights.sbomify.com/CVE-2026-50029/index.md)","id":"CVE-2026-50029","markdown":"https://insights.sbomify.com/CVE-2026-50029/index.md","name":"CVE-2026-50029","record":{"aliases":["GHSA-m34p-749j-x6m6"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript TOML parser","requires_auth":"none","summary":"Attackers can bypass security checks in applications using js-toml by exploiting a duplicate-key parsing flaw that converts falsy values into truthy objects.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-697","name":"Incorrect Comparison"}],"description":"js-toml is a TOML parser for JavaScript, Prior to version 1.1.2, the interpreter checks whether a key already exists in a parser-built container with `if (object[key])` instead of `if (key in object)`. When the prior value is a falsy primitive — `false`, `0`, `0n`, `0.0`, `-0`, or `\"\"` — the duplicate-key branch is skipped and the value is silently overwritten by a later sub-table, dotted-key sub-table, or array-of-tables sharing the same name. Per the TOML 1.0.0 spec (\"Defining a key multiple times is invalid\"; \"You cannot define any key or table more than once\"), this should be a parse error. The result is structural type confusion of attacker-named keys in the value returned by `load()`. A boolean-typed `false` (or numeric `0`) becomes a truthy object. Host applications that gate behavior on `if (config.flag)`, `if (!user.banned)`, `if (config.allowDelete)`, or `if (config.publicMode)` will silently take the truthy branch. This is distinct from GHSA-65fc-cr5f-v7r2 (the 1.0.2 prototype-pollution fix). `Object.prototype` is not polluted. The `Object.create(null)` mitigation from 1.0.2 is intact; the bug here is in the duplicate-key state machine, not in container construction. Version 1.1.2 patches the incorrect comparison.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"js-toml has silent type confusion via falsy-primitive duplicate-key bypass","id":"CVE-2026-50029","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"business_logic","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"DataEase: Arbitrary SQL execution in preview path (direct data disclosure)","id":"CVE-2026-50030"},"packages":[{"ecosystem":"npm","fixed":["1.1.2"],"introduced":["0"],"last_affected":[],"package":"js-toml","purl":null,"source":"GHSA-m34p-749j-x6m6"},{"ecosystem":"npm","fixed":["1.1.2"],"introduced":["0"],"last_affected":[],"package":"js-toml","purl":"pkg:npm/js-toml","source":"GHSA-m34p-749j-x6m6"}],"prev":{"headline":"mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/Delete","id":"CVE-2026-50027"},"products":["js-toml"],"published":"2026-08-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-17","vendors":["sunnyadn"]},"summary":"Attackers can bypass security checks in applications using js-toml by exploiting a duplicate-key parsing flaw that converts falsy values into truthy objects.","url":"https://insights.sbomify.com/CVE-2026-50029/"}