CVE-2026-82404: TOON Serialization Library RCE Vulnerability

CVE-2026-82404 Overview

CVE-2026-82404 is a prototype pollution vulnerability [CWE-1321] in TOON, a compact JSON serialization format used for large language model (LLM) prompts. Versions prior to 2.3.1 fail to sanitize dangerous keys such as __proto__, constructor, and prototype during decode. Attackers who supply crafted TOON input can write through the object prototype chain, polluting Object.prototype across the entire runtime. Services that decode untrusted TOON may experience denial of service or, when a suitable downstream gadget exists, remote code execution. The issue is fixed in version 2.3.1.

Critical Impact

Untrusted TOON input processed by a vulnerable decoder can poison Object.prototype process-wide, enabling denial of service and potentially remote code execution.

Affected Products

• TOON (@toon-format/toon) versions prior to 2.3.1
• Services and LLM tooling that decode attacker-controlled TOON payloads
• Applications relying on expandPaths: 'safe' or streaming decode paths in TOON

Discovery Timeline

• 2026-09-02 - CVE-2026-82404 published to the National Vulnerability Database (NVD)
• 2026-09-02 - Last updated in NVD database
• Fixed release TOON v2.3.1 and GHSA-p95v-992w-h6c3 published by the maintainers

Technical Details for CVE-2026-82404

Vulnerability Analysis

The vulnerability resides in the TOON decoder pipeline, specifically packages/toon/src/decode/expand.ts. When decoding, the expandPaths: 'safe' path and the insertPathSafe function walk dotted key segments and assign values without verifying that each segment refers to an own property. A key such as a.__proto__.x traverses the prototype chain and mutates Object.prototype instead of creating a nested own property.

The issue extends beyond dotted keys. Plain nested objects, tabular rows, quoted keys, and streaming decode all reach the same unsafe assignment logic. The encoder side also drops legitimate own __proto__ properties and can invoke inherited setters during normalization, broadening the attack surface.

Root Cause

The root cause is missing own-property enforcement during object construction in the decoder. The code used ordinary property assignment on freshly created objects, which resolves __proto__, constructor, and prototype against the shared prototype chain. The patch introduces getOwnProperty and setOwnProperty helpers from packages/toon/src/shared/object-utils.ts and routes all decode-time writes through them.

Attack Vector

Exploitation requires only that a service pass attacker-controlled TOON to the decoder. No authentication or user interaction is needed. A polluted Object.prototype can flip application-wide defaults, corrupt option objects, or introduce attacker-defined properties that downstream code trusts. When a suitable gadget exists in the runtime, this pattern is a well-documented path to remote code execution in Node.js environments.

// Security patch: packages/toon/src/decode/expand.ts
 import type { JsonObject, JsonValue } from '../types.ts'
 import { DOT } from '../constants.ts'
 import { isJsonObject } from '../encode/normalize.ts'
+import { getOwnProperty, setOwnProperty } from '../shared/object-utils.ts'
 import { isIdentifierSegment } from '../shared/validation.ts'

 // #region Path expansion (safe)

// Security patch: packages/toon/src/decode/event-builder.ts
 import type { JsonObject, JsonStreamEvent, JsonValue } from '../types.ts'
+import { setOwnProperty } from '../shared/object-utils.ts'
 import { QUOTED_KEY_MARKER } from './expand.ts'

Source: GitHub commit 94a2b75. The patch replaces direct property writes with setOwnProperty, which uses Object.defineProperty semantics to create own properties without traversing the prototype chain.

Detection Methods for CVE-2026-82404

Indicators of Compromise

• TOON payloads containing the literal segments __proto__, constructor, or prototype as object keys or within dotted paths such as a.__proto__.polluted
• Runtime anomalies where objects created via {} unexpectedly expose properties they never received directly
• Unexpected changes in application configuration behavior after processing user-supplied TOON documents

Detection Strategies

• Perform software composition analysis (SCA) to identify @toon-format/toon dependencies below version 2.3.1 in direct and transitive dependencies
• Inspect ingress logs and message queues for TOON payloads whose keys match __proto__, constructor.prototype, or prototype patterns
• Instrument Node.js processes to detect writes to Object.prototype at runtime, for example by freezing the prototype during startup and alerting on TypeError

Monitoring Recommendations

• Ingest application, container, and Node.js runtime logs into a centralized data lake and alert on TypeError events referencing Object.prototype
• Monitor for abnormal child process spawns, outbound connections, or file writes from services that decode TOON, which may indicate gadget-based code execution following pollution
• Track dependency drift and flag any regression to TOON versions earlier than 2.3.1 in build pipelines

How to Mitigate CVE-2026-82404

Immediate Actions Required

• Upgrade @toon-format/toon to version 2.3.1 or later across all services, workers, and LLM tooling that parses TOON
• Audit application code for downstream gadgets that could convert prototype pollution into remote code execution, such as template engines or option-merging routines
• Reject or quarantine TOON payloads containing __proto__, constructor, or prototype at the API gateway until the upgrade is complete

Patch Information

The vulnerability is fixed in TOON v2.3.1. Details are published in GHSA-p95v-992w-h6c3 and merged via pull request #316. The fix introduces setOwnProperty and getOwnProperty helpers and routes all decode-time writes, including streaming decode and safe path expansion, through them.

Workarounds

• If upgrading is not immediately possible, pre-validate incoming TOON with a strict schema that rejects reserved key names
• Freeze Object.prototype at process startup with Object.freeze(Object.prototype) to convert pollution attempts into runtime errors
• Isolate TOON decoding in a sandboxed worker with the least privilege necessary and no access to secrets or child process APIs

# Upgrade to the patched TOON release
npm install @toon-format/toon@2.3.1

# Verify the resolved version across the dependency tree
npm ls @toon-format/toon

# Optional runtime hardening in the application entry point
node -e "Object.freeze(Object.prototype); require('./server.js')"