6 matches found
@apify/actors-mcp-server (>=0.10.13-beta.4, <=0.11.6-beta.2), @barney-media/crap-typescript-core (>=0.5.0, <=0.5.1) +72 more potentially affected by CVE-2026-82404 via @toon-format/toon (>=2.1.0, <=2.3.0)
@toon-format/toon NPM version =2.1.0, =0.10.13-beta.4, =0.5.0, =0.1.0, =0.0.232, =0.0.232, =0.0.232, =1.7.0, =0.1.0, =0.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.11 and more Source cves: CVE-2026-82404 Source advisory: OSV:GHSA-P95V-992W-H6C3...
TOON: Prototype pollution when decoding untrusted TOON input
Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...
GHSA-P95V-992W-H6C3 TOON: Prototype pollution when decoding untrusted TOON input
Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...
@apify/actors-mcp-server (>=0.10.13-beta.4, <=0.11.6-beta.2), @barney-media/crap-typescript-core (>=0.5.0, <=0.5.1) +72 more potentially affected by CVE-2026-82404 via @toon-format/toon (>=2.1.0, <=2.3.0)
@toon-format/toon NPM version =2.1.0, =0.10.13-beta.4, =0.5.0, =0.1.0, =0.0.232, =0.0.232, =0.0.232, =1.7.0, =0.1.0, =0.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.11 and more Source cves: CVE-2026-82404 Source advisory: GHSA-P95V-992W-H6C3...
@agent-society/bls (1.0.0), @agent-society/relay (1.0.0) +222 more potentially affected by CVE-2026-82404 via @toon-format/toon (>=0.6.0, <=2.3.0)
@toon-format/toon NPM version =0.6.0, =1.0.21-beta, =2025.3.7, =1.0.0, =0.10.13-beta.4, =2.2.7, =1.0.0, =0.5.0, =0.1.0, =0.0.232, =0.0.232, =0.0.232, =1.2.1, =1.4.0 and more Source cves: CVE-2026-82404 Source advisory: MEND:CVE-2026-82404...
Beyond JSON: Converting Spring AI Tool Response Formats to TOON, XML, CSV, YAML, ...
JSON is the go-to format for LLM tool responses, but recent discussions around alternative formats like TOON Token-Oriented Object Notation claim potential benefits in token efficiency and performance. While the debate continues—with critical analyses pointing to context-dependent results—the...