EUVD-2026-70214Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
S:C reflects runtime-wide prototype pollution; A:H because DoS is reliably achievable without gadgets; C:L/I:L because RCE and data access require an additional downstream gadget chain.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.__proto__.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own __proto__ properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.
AnalysisAI
Prototype pollution in the TOON serialization library (all versions prior to 2.3.1) allows unauthenticated remote attackers to corrupt Object.prototype in any Node.js application that decodes attacker-controlled TOON input. The vulnerability spans multiple decode paths - dotted-key expansion via __proto__, plain nested objects, tabular rows, quoted keys, and streaming decode - as well as the encoder's normalization pipeline. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target service must pass externally controlled data directly to the TOON `decode()` function without prior key sanitization; any API endpoint, webhook processor, or file ingestion pipeline that feeds untrusted TOON content into the library satisfies this condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.3 vector (AV:N/AC:L/PR:N/UI:N/S:C) correctly identifies this as a zero-prerequisite, network-exploitable vulnerability with a scope change, because prototype pollution escapes the TOON parser boundary and corrupts the entire Node.js runtime's shared object prototype. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to toon v2.3.1 or later immediately; this release is confirmed available at https://github.com/toon-format/toon/releases/tag/v2.3.1 and addresses every affected code path in both the decode and encode pipelines via PR #316 (commit 94a2b75). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Node.js applications using TOON library and determine their current versions and business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this
Share
External POC / Exploit Code
Leaving vuln.today