TOON library bug can corrupt or hijack JS apps

Published September 3, 2026 CVE-2026-82404

A bug in the TOON data format library let attackers plant hidden keys in the text they send to an app, which then corrupted core JavaScript behavior for every user on that server at once. Depending on what else the app does with that corrupted state, this could crash the service or let an attacker run their own code on it.

Severity
HighCVSS 3.1 · 8.3
Fix
Fixed in 2.3.1Fix recorded on Sep 3, 2026
Affected versions
before 2.3.1
Weakness
CWE-1321Prototype Pollution
Exploit likelihood
0.40% in 30 daysEPSS, higher than 33% of known flaws
Affects
@toon-format/toon

How it works

When the library reads TOON text containing a key named proto, constructor, or prototype, it wrote that value straight onto JavaScript's shared prototype object instead of storing it as a normal, isolated property, corrupting behavior across the whole app.

What to do

Run npm ls @toon-format/toon in your project and check whether the installed version is earlier than 2.3.1, especially if your code decodes TOON input that outside users can influence.

Run this in the application environment you want to check:

npm ls @toon-format/toon

Update to @toon-format/toon version 2.3.1 or later with npm install @toon-format/toon@2.3.1. There is no workaround besides upgrading, though you can also reject any input containing __proto__, constructor, or prototype keys before decoding as a stopgap.

Technical details

Affected software: @toon-format/toon

The flaw sits in packages/toon/src/decode/expand.ts. The expandPaths: 'safe' path and insertPathSafe function used obj[key] = value style assignment while expanding dotted keys, so a key like a.proto.x traversed the prototype chain instead of creating an own property. Plain nested objects, tabular rows, quoted keys, and streaming decode were also affected, and the encoder separately dropped own proto properties while risking firing an inherited setter during normalization. Version 2.3.1 makes decoders materialize proto, constructor, and prototype as ordinary own data properties, matching JSON.parse semantics.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact Low Some data can be read
  • Integrity impact Low Some data can be modified
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L Open in FIRST.org calculator

References

View Original Source