squirrelchat smol-toml up to 1.7.0 TOML Parser src/util.ts skipUntil infinite loop

Summaryinfo

A vulnerability was found in squirrelchat smol-toml up to 1.7.0 and classified as problematic. Affected by this issue is the function skipUntil of the file src/util.ts of the component TOML Parser. Executing a manipulation can lead to infinite loop. The identification of this vulnerability is CVE-2026-85730. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in squirrelchat smol-toml up to 1.7.0. It has been declared as problematic. This vulnerability affects the function skipUntil of the file src/util.ts of the component TOML Parser. The manipulation with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. CVE summarizes:

smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-85730 since 09/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.7.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Vendor

• squirrelchat

Name

• smol-toml

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7.0

Website

• Product: https://github.com/squirrelchat/smol-toml/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion