CVE-2026-82404: TOON: Prototype pollution when decoding untrusted TOON input
Summary
Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path (dotted keys such as a.proto.x) was the strongest vector; plain nested objects, tabular rows, and quoted keys were all affected. The encoder had a matching defect: it silently dropped own proto properties and could fire an inherited setter while normalizing.
Impact
Any service that decodes untrusted TOON is affected. Prototype pollution can escalate to denial of service or, with a suitable downstream gadget, remote code execution.
Patches
Upgrade to @toon-format/toon@2.3.1. Decoders now materialize proto/constructor/prototype as ordinary own data properties, matching JSON.parse semantics; the encoder preserves the same keys without invoking inherited accessors.
Workarounds
None. Upgrade is the only fix. Callers who cannot upgrade should reject input whose keys include proto, constructor, or prototype before decoding.
Port maintainers
The same bug shape can exist in any implementation that assigns decoded keys with obj[key] = value. Rust, Swift, Java, Python, and C# ports should audit their object-construction and path-expansion paths for the three prototype keys.
Other sources
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.proto.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own proto properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@toon-format/toonto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
@toon-format/toonto a version that resolves this vulnerability.Fixed in 2.3.1 - Compensating control
For callers that cannot upgrade, reject input whose keys include `__proto__`, `constructor`, or `prototype` before decoding.
Event History
Frequently Asked Questions
Which deployments are exposed?
Services that decode attacker-controlled TOON input are exposed. The issue can affect the runtime globally by polluting Object.prototype, including through dotted keys, plain nested objects, tabular rows, quoted keys, and streaming decode.
What does an attacker need to exploit this?
An attacker needs to supply TOON input for decoding; the listed vector requires no privileges or user interaction. Payloads using __proto__, constructor, or prototype keys can trigger prototype-chain writes, with dotted paths such as a.__proto__.x identified as the strongest vector.
Are there risks beyond decoding?
Yes. The encoder could drop own __proto__ properties and could invoke an inherited setter during normalization. The described impact includes denial of service and potentially remote code execution when a suitable downstream gadget is present.
What version resolves the issue?
Upgrade TOON to version 2.3.1. Versions prior to 2.3.1 are affected.