Description

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.__proto__.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own __proto__ properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-02T17:18:00.223Z",
  "pubdate": "2026-09-02T17:18:00.223Z",
  "executiveSummary": "The TOON library, prior to version 2.3.1, is susceptible to a critical Prototype Pollution vulnerability. This security flaw stems from improper input sanitization during the decoding of serialized data, allowing an attacker to inject arbitrary properties into the global Object.prototype.\nBy manipulating the object prototype chain, a remote attacker can influence the behavior of the entire JavaScript runtime environment. This can lead to severe consequences, including Denial of Service (DoS) by disrupting application logic or Remote Code Execution (RCE) if the application utilizes downstream gadgets that rely on inherited properties.\nThe vulnerability affects all services that process untrusted TOON-serialized data using affected versions. Because the injection occurs during the decoding phase, no specific authentication is required to trigger the payload, making this an attractive vector for unauthenticated attackers. Organizations utilizing affected versions are at high risk of system compromise and should prioritize upgrading to version 2.3.1 immediately.",
  "technicalDetails": "The vulnerability is a classic case of Prototype Pollution occurring within the object deserialization logic of the TOON library. The root cause lies in the insufficient validation of keys during the decoding process, specifically within packages/toon/src/decode/expand.ts.\nDuring deserialization, the decoder fails to block or sanitize keys such as '__proto__', 'constructor', or 'prototype'. When these keys are processed—particularly through the 'safe' expandPaths implementation and the insertPathSafe function—the decoder does not restrict the write operation to the target object's own properties. Instead, it follows the prototype chain, allowing the attacker to overwrite or inject properties directly into the base Object.prototype.\nThe attack flow initiates when an attacker submits a maliciously crafted TOON payload to an application endpoint. If the payload contains dotted key paths (e.g., 'a.__proto__.x'), the insertPathSafe function incorrectly traverses the prototype chain. Beyond dotted paths, the vulnerability is further exacerbated by the library's handling of plain nested objects, tabular rows, and quoted keys. Additionally, the encoder’s behavior contributes to the risk by dropping own '__proto__' properties, which may inadvertently trigger inherited setters during the data normalization phase.\nThe impact is significant: by polluting the global Object.prototype, an attacker can redefine existing methods, overwrite configuration properties, or change the default behavior of objects throughout the execution context. In scenarios where the application employs 'gadgets'—existing code structures that consume properties from objects—the attacker can leverage this pollution to redirect execution flow, potentially leading to arbitrary command execution or application crashes.\nThis vulnerability is present in versions of the TOON library prior to 2.3.1. It requires no elevated privileges or prior authentication, as the pollution occurs as a side effect of normal data processing. The vector is particularly dangerous because the side effects of prototype pollution often persist for the lifetime of the process, affecting all subsequent operations within that runtime instance."
}