CVE-2026-82404

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.proto.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own proto properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.proto.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own proto properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.

Summary

Decoding attacker-controlled TOON containing a __proto__, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path (dotted keys such as a.__proto__.x) was the strongest vector; plain nested objects, tabular rows, and quoted keys were all affected. The encoder had a matching defect: it silently dropped own __proto__ properties and could fire an inherited setter while normalizing.

Impact

Any service that decodes untrusted TOON is affected. Prototype pollution can escalate to denial of service or, with a suitable downstream gadget, remote code execution.

Patches

Upgrade to @toon-format/toon@2.3.1. Decoders now materialize __proto__/constructor/prototype as ordinary own data properties, matching JSON.parse semantics; the encoder preserves the same keys without invoking inherited accessors.

Workarounds

None. Upgrade is the only fix. Callers who cannot upgrade should reject input whose keys include __proto__, constructor, or prototype before decoding.

Port maintainers

The same bug shape can exist in any implementation that assigns decoded keys with obj[key] = value. Rust, Swift, Java, Python, and C# ports should audit their object-construction and path-expansion paths for the three prototype keys.

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.proto.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own proto properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.proto.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own proto properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.

Summary

Decoding attacker-controlled TOON containing a __proto__, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path (dotted keys such as a.__proto__.x) was the strongest vector; plain nested objects, tabular rows, and quoted keys were all affected. The encoder had a matching defect: it silently dropped own __proto__ properties and could fire an inherited setter while normalizing.

Impact

Any service that decodes untrusted TOON is affected. Prototype pollution can escalate to denial of service or, with a suitable downstream gadget, remote code execution.

Patches

Upgrade to @toon-format/toon@2.3.1. Decoders now materialize __proto__/constructor/prototype as ordinary own data properties, matching JSON.parse semantics; the encoder preserves the same keys without invoking inherited accessors.

Workarounds

None. Upgrade is the only fix. Callers who cannot upgrade should reject input whose keys include __proto__, constructor, or prototype before decoding.

Port maintainers

The same bug shape can exist in any implementation that assigns decoded keys with obj[key] = value. Rust, Swift, Java, Python, and C# ports should audit their object-construction and path-expansion paths for the three prototype keys.