A high-severity prototype pollution vulnerability, tracked as CVE-2026-82404 with a CVSS score of 8.3, exists in the TOON format's decoder and encoder due to improper handling of attacker-controlled input containing __proto__, constructor, or prototype keys. This flaw allows attackers to write through the object's prototype chain, potentially leading to denial of service or remote code execution in any service that decodes untrusted TOON input. The vulnerability arises from the decoder not creating an own property when decoding such input, instead writing through the object's prototype chain, while the encoder silently drops own __proto__ properties and may fire an inherited setter during normalization. This issue affects services using untrusted TOON input and can be mitigated by upgrading to a fixed version of the affected package, specifically @toon-format/toon prior to 2.3.1.
We recommend you to update @toon-format/toon to version 2.3.1.[/subscribe_to_unlock_form]
A high-severity prototype pollution vulnerability, tracked as CVE-2026-82404 with a CVSS score of 8.3, exists in the TOON format's decoder and encoder due to improper handling of attacker-controlled input containing __proto__, constructor, or prototype keys. This flaw allows attackers to write through the object's prototype chain, potentially leading to denial of service or remote code execution in any service that decodes untrusted TOON input. The vulnerability arises from the decoder not creating an own property when decoding such input, instead writing through the object's prototype chain, while the encoder silently drops own __proto__ properties and may fire an inherited setter during normalization. This issue affects services using untrusted TOON input and can be mitigated by upgrading to a fixed version of the affected package, specifically @toon-format/toon prior to 2.3.1.
We recommend you to update @toon-format/toon to version 2.3.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]