CVE-2026-50029: 
JavaScript Análise e mitigação de vulnerabilidades

CVE-2026-50029 is a silent type confusion vulnerability in js-toml, a TOML parser for JavaScript (npm), caused by an incorrect key-existence check in the parser's interpreter. Affecting all versions up to and including 1.1.1, the flaw allows spec-violating TOML input to silently overwrite falsy primitive values (false, 0, 0n, 0.0, -0, "") with truthy objects, bypassing security gates in host applications. The vulnerability was reported by researcher CosmicCrusader23, published by the maintainer on May 28, 2026, and added to the GitHub Advisory Database on June 26, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, js-toml Advisory).

The root cause is an incorrect comparison (CWE-697) in src/load/interpreter.ts at two locations: Interpreter.tryCreatingObject (line 214) and Interpreter.getOrCreateArray (line 278). Both use truthy checks (if (object[key]) and if (object[first] && ...)) instead of the correct in operator (if (key in object)) to detect whether a key already exists in a parser-built container. Because containers are created via Object.create(null), the in operator would unambiguously check only own keys, but the truthy check causes falsy primitives to be treated as absent, allowing a later sub-table, dotted-key sub-table, or array-of-tables with the same name to silently overwrite the value. The bug is reachable through all three interpreter paths: assignValue (dotted keys), createTable ([stdTable] headers), and getOrCreateArray ([[arrayOfTables]] headers). A public PoC is included in the advisory (js-toml Advisory, Patch Commit).

Successful exploitation results in structural type confusion: a boolean false or numeric 0 value in a parsed configuration object is silently replaced by a truthy object, causing host applications to incorrectly evaluate security-relevant conditional checks. Applications gating behavior on expressions such as if (config.isAdmin), if (!user.banned), if (config.allowDelete), or if (config.publicMode) will silently take the truthy branch, potentially granting unauthorized access, bypassing bans, or enabling destructive operations. The integrity impact is low and scoped to the parsed configuration object; there is no confidentiality or availability impact, and Object.prototype is not polluted (GitHub Advisory).

A public proof-of-concept is included in the official advisory and is trivially reproducible with a crafted TOML string. The vulnerability requires no authentication, no privileges, and no user interaction, making it automatable (confirmed by NVD SSVC). The EPSS score is approximately 0.232% (14th percentile), indicating a relatively low but non-negligible probability of exploitation in the wild within 30 days. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, js-toml Advisory).

1. Identify target: Locate a Node.js application that uses js-toml version ≤ 1.1.1 to parse TOML configuration files or user-supplied TOML input, and that gates security-relevant behavior on parsed boolean or numeric flags.
2. Craft malicious TOML input: Construct a TOML document that first defines a security-relevant key with a falsy primitive value, then redefines it as a table or array-of-tables:

isAdmin = false
[isAdmin]
forced = "yes"

3. Deliver the payload: Supply the crafted TOML to the application through any input vector that reaches the load() function — e.g., a user-editable config file, an API endpoint accepting TOML, or a file upload.
4. Trigger type confusion: The parser's truthy check (if (object[key])) evaluates false as absent, skips the duplicate-key error, and overwrites the false value with the object {forced: "yes"}.
5. Bypass security gate: The host application evaluates if (config.isAdmin) — now a truthy object — and grants the attacker access to admin-only code paths, bypasses ban checks, or enables restricted operations (js-toml Advisory, Patch Commit).

• Application Behavior: Unexpected elevation of privileges or bypass of access controls in applications using TOML-based configuration; admin or restricted features accessible to unauthorized users.
• Logs: Application logs showing privileged actions performed by accounts or sessions that should have been restricted (e.g., banned users performing actions, non-admin users accessing admin endpoints).
• File System: Presence of TOML configuration files containing duplicate key definitions where a falsy primitive (e.g., false, 0, "") is followed by a table header or dotted-key sub-table of the same name (e.g., isAdmin = false followed by [isAdmin]).
• Dependency Audit: package.json or package-lock.json referencing js-toml at version ≤ 1.1.1, detectable via npm audit or dependency scanning tools (GitHub Advisory).

Upgrade js-toml to version 1.1.2 or later, which fixes both incorrect comparisons in src/load/interpreter.ts by replacing truthy checks with the in operator (js-toml Release, Patch Commit). No configuration-based workaround is available; the fix must be applied at the library level. As a defense-in-depth measure, applications should avoid relying solely on parsed TOML values for security-critical boolean checks and should validate parsed configuration objects against an expected schema before use.