TOON serialization format vulnerable to prototype pollution via __proto__/constructor keys in LLM prompt data

Published Sept 2, 2026 (CVSS 8.3), TOON is a compact serialization format specifically designed for LLM prompts; prior to 2.3.1 it did not guard against prototype-pollution keys during decoding.

Because TOON is purpose-built for LLM prompt data (often containing content influenced by untrusted users or retrieved documents in RAG pipelines), this is a direct injection path from LLM-adjacent data into JavaScript runtime state, though blast radius is currently limited to a single, relatively niche library.

Decoding attacker-controlled TOON-serialized data containing __proto__, constructor, or prototype keys writes through the object prototype chain instead of creating an own property, polluting Object.prototype for the entire runtime process — potentially affecting downstream logic across the application that processes LLM prompts/responses.

TOON (toon-format) prior to 2.3.1

Upgrade to TOON 2.3.1 or later. See commit 94a2b7560b2b5ed903a4d466a3bce8b13daa2660.