Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@toon-format/toon

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.3npmPublished

    TOON: Prototype pollution when decoding untrusted TOON input

    CVE-2026-82404 · GHSA-p95v-992w-h6c3

    Affected
    • npm @toon-format/toon < 2.3.1
    Fixed in
    2.3.1· Vendor fix available
    Issue
    Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path (dotted keys such as a.proto.x) was the strongest vector; plain nested objects, tabular rows, and quoted keys were all affected. The encoder had a matching defect: it silently dropped own proto properties and could fire an inherited setter while normalizing. Impact Any service that decodes untrusted TOON is affected. Prototype pollution can escalate to denial of service or, with a suitable downstream gadget, remote code execution. Patches Upgrade to @toon-format/toon@2.3.1. Decoders now materialize proto/constructor/prototype as ordinary own data properties, matching JSON.parse semantics; the encoder preserves the same keys without invoking inherited accessors. Workarounds None. Upgrade is the only fix. Callers who cannot upgrade should…

    Recommended action: Upgrade to 2.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →