CVE-2026-82404

Name of the Vulnerable Software and Affected Versions TOON versions prior to 2.3.1

Description Decoding attacker-controlled TOON data containing proto, constructor, or prototype keys allows for prototype pollution of Object.prototype for the runtime. This occurs because the software writes through the object prototype chain instead of creating an own property. In the file packages/toon/src/decode/expand.ts, the insertPathSafe function and the expandPaths: 'safe' path make dotted keys like a. proto .x a primary vector, although plain nested objects, tabular rows, quoted keys, and streaming decode are also affected. Additionally, the encoder may drop own proto properties and invoke an inherited setter during normalization. This can lead to denial of service or remote code execution if a suitable downstream gadget is present.

Recommendations Update to version 2.3.1.