THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-p95v-992w-h6c3 (high) — TOON: Prototype pollution when decoding untrusted TOON input

[GHSA] GHSA-p95v-992w-h6c3 (high) — TOON: Prototype pollution when decoding untrusted TOON input

medgithub_advisoriesPublished 2026-09-03

GHSA-p95v-992w-h6c3 Severity: high CVE: CVE-2026-82404

TOON: Prototype pollution when decoding untrusted TOON input

### Summary

Decoding attacker-controlled TOON containing a `__proto__`, `constructor`, or `prototype` key wrote through the object's prototype chain instead of creating an own property, polluting `Object.prototype` for the whole runtime. The `expandPaths: 'safe'` path (dotted keys

Indicators of compromise

Original source: https://github.com/advisories/GHSA-p95v-992w-h6c3