TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

GHSA-P95V-992W-H6C3 TOON: Prototype pollution when decoding untrusted TOON input

Summary Decoding attacker-controlled TOON containing a proto, constructor, or prototype key wrote through the object's prototype chain instead of creating an own property, polluting Object.prototype for the whole runtime. The expandPaths: 'safe' path dotted keys such as a.proto.x was the stronges...

@apify/actors-mcp-server (>=0.10.13-beta.4, <=0.11.6-beta.2), @barney-media/crap-typescript-core (>=0.5.0, <=0.5.1) +69 more potentially affected by CVE-2026-82404 via @toon-format/toon (>=2.1.0, <=2.3.0)

@toon-format/toon NPM version =2.1.0, =0.10.13-beta.4, =0.5.0, =0.1.0, =0.0.232, =0.0.232, =0.0.232, =1.7.0, =0.1.0, =0.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.1.0, =8.7.10 and more Source cves: CVE-2026-82404 Source advisory: OSV:GHSA-P95V-992W-H6C3...