CVE-2026-82404: TOON format prototype pollution in decoder

Executive brief

TOON is a data serialization format similar to JSON. The decoder improperly handles special object keys like `__proto__`, `constructor`, and `prototype`, causing prototype pollution that contaminates the global Object.prototype. An attacker who can supply untrusted TOON input to a service can poison shared object properties, leading to service disruption or—with the right gadget chain—remote code execution.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the TOON format decoder. The decoder used unsafe object property assignment (`obj[key] = value`) when processing decoded keys, including the three special prototype keys. Multiple attack vectors existed: dotted keys with `expandPaths: 'safe'` (e.g., `a.__proto__.x`), plain nested objects, tabular rows, and quoted keys. The encoder had the reciprocal bug, silently dropping own `__proto__` properties and potentially firing inherited setters during normalization. No authentication or user interaction is required; the attack surface is network-wide if the service processes untrusted TOON. The fix (version 2.3.1 and later) materializes these keys as ordinary own data properties, matching JSON.parse semantics. No active exploitation in the wild has been reported.

Affected products

• toon-format @toon-format/toon < 2.3.1

Timeline

• 2026-07-16: disclosed
• 2026-09-03: advisory
• 2026-09-03: patched: Version 2.3.1 released with fix

References

• https://api.github.com/users/ckorhonen
• https://github.com/ckorhonen
• https://api.github.com/users/ckorhonen/gists%7B/gist_id%7D
• https://api.github.com/users/ckorhonen/repos
• https://avatars.githubusercontent.com/u/39121?v=4
• https://api.github.com/users/ckorhonen/events%7B/privacy%7D