CVE-2026-82404 Details
Description
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.__proto__.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own __proto__ properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.
A prototype pollution vulnerability has been identified in TOON, a serialization format for JSON data used in LLM prompts. This issue affects versions prior to 2.3.1. The vulnerability arises when TOON data controlled by an attacker is decoded, particularly if it contains `__proto__`, `constructor`, or `prototype` keys. Instead of creating own properties, the decoding process writes through the prototype chain, leading to pollution of `Object.prototype` in the runtime. This vulnerability can cause denial-of-service conditions or, if a suitable downstream gadget is available, remote code execution. The problem is exacerbated by the encoder, which drops own `__proto__` properties and can trigger inherited setters during normalization.
Upgrade TOON to version 2.3.1 or later. This version fixes the vulnerability by ensuring that `__proto__`, `constructor`, and `prototype` keys are treated as ordinary own properties, similar to how `JSON.parse` handles them. For those unable to upgrade, it is recommended to reject any TOON input containing these keys before decoding.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/toon-format/toon/commit/94a2b7560b2b5ed903a4d466a3bce8b13daa2660 | [email protected] | Source CodeVendor |
| https://github.com/toon-format/toon/pull/316 | [email protected] | Source CodeVendor |
| https://github.com/toon-format/toon/releases/tag/v2.3.1 | [email protected] | Release NotesVendor |
| https://github.com/toon-format/toon/security/advisories/GHSA-p95v-992w-h6c3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| toon-format toon | < 2.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |