GHSA-p95v-992w-h6c3: High severity npm/@toon-format/toon vulnerability
Summary
Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path (dotted keys such as a.proto.x) was the strongest vector; plain nested objects, tabular rows, and quoted keys were all affected. The encoder had a matching defect: it silently dropped own proto properties and could fire an inherited setter while normalizing.
Impact
Any service that decodes untrusted TOON is affected. Prototype pollution can escalate to denial of service or, with a suitable downstream gadget, remote code execution.
Patches
Upgrade to @toon-format/toon@2.3.1. Decoders now materialize proto/constructor/prototype as ordinary own data properties, matching JSON.parse semantics; the encoder preserves the same keys without invoking inherited accessors.
Workarounds
None. Upgrade is the only fix. Callers who cannot upgrade should reject input whose keys include proto, constructor, or prototype before decoding.
Port maintainers
The same bug shape can exist in any implementation that assigns decoded keys with obj[key] = value. Rust, Swift, Java, Python, and C# ports should audit their object-construction and path-expansion paths for the three prototype keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@toon-format/toonto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
@toon-format/toonto a version that resolves this vulnerability.Fixed in 2.3.1 - Configuration
If using the `expandPaths: 'safe'` path expansion mode, avoid decoding attacker-controlled TOON with prototype keys (`__proto__`, `constructor`, `prototype`), since dotted keys (e.g., `a.__proto__.x`) were the strongest vector.
TOON decoders/encoders expandPaths = safe (dotted keys like `a.__proto__.x`) - Compensating control
For callers that cannot upgrade: reject (do not decode) any untrusted TOON input whose keys include `__proto__`, `constructor`, or `prototype` before decoding.
- Compensating control
For other ports (Rust, Swift, Java, Python, C#): audit object-construction and path-expansion code paths to ensure decoded keys with `__proto__`, `constructor`, or `prototype` do not get assigned through the object prototype chain (e.g., avoid `obj[key] = value` semantics that can trigger prototype pollution).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Any service that decodes untrusted TOON input is affected. The impact can range from denial of service to remote code execution when a suitable downstream gadget is present.
What does an attacker need to include in TOON input to trigger the issue?
The attacker-controlled input must contain a __proto__, constructor, or prototype key. Dotted paths processed with expandPaths: 'safe', such as a.__proto__.x, are the strongest vector; nested objects, tabular rows, and quoted keys are also affected.
What should be done if upgrading cannot happen immediately?
There is no complete workaround other than upgrading. Before decoding, reject input whose keys include __proto__, constructor, or prototype.
How does the fixed release change decoder and encoder behavior?
Version 2.3.1 materializes __proto__, constructor, and prototype as ordinary own data properties during decoding. It also preserves those own properties during encoding without invoking inherited accessors.