CVE-2026-82404

TOON, an npm library for compact, human-readable serialization of JSON-like data used in LLM prompts, is vulnerable to prototype pollution (CWE-1321): before version 2.3.1, decoding attacker-controlled TOON containing __proto__, constructor, or prototype keys wrote through the object prototype chain and polluted Object.prototype for the entire runtime instead of creating an own property. The strongest vector is dotted keys such as a.__proto__.x handled by the expandPaths 'safe' path and insertPathSafe function, while plain nested objects, tabular rows, quoted keys, and streaming decode are also affected, and the encoder additionally drops own __proto__ properties and can invoke an inherited setter during normalization. An attacker who can feed crafted TOON to a decoding service gains denial of service in any application, and potentially remote code execution when a suitable downstream gadget is present. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation is reported, and EPSS currently estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade the toon npm package to version 2.3.1 or later. Audit whether your services decode TOON from untrusted sources (e.g., user-supplied or model-generated prompt data), and until patched, strip or reject keys named __proto__, constructor, or prototype, or decode into null-prototype objects with schema validation. Also review downstream code (merge/mass-assignment patterns) for gadgets that could escalate Object.prototype pollution into remote code execution.