Vulnerabilidad · Publicado 02/09/2026 · Actualizado 03/09/2026
TOON, librería de serialización compacta para prompts de LLM, contiene una falla de contaminación de prototipos (prototype pollution) en versiones anteriores a 2.3.1. Un atacante puede manipular datos TOON con claves __proto__, constructor o prototype para modificar Object.prototype en tiempo de ejecución, comprometiendo la integridad de aplicaciones que procesen datos no validados. El riesgo es alta en plataformas que integren LLM con entrada de usuario.
TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In packages/toon/src/decode/expand.ts, the expandPaths: 'safe' path and insertPathSafe function made dotted keys such as a.__proto__.x the strongest vector, while plain nested objects, tabular rows, quoted keys, and streaming decode were also affected. The encoder also dropped own __proto__ properties and could invoke an inherited setter during normalization. Services that decode untrusted TOON could experience denial of service or, when a suitable downstream gadget is present, remote code execution. This issue is fixed in version 2.3.1.
Score: 8.3/10 — Severidad: HIGH — Estado NIST: Received
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CWE-1321
Publicado en NIST NVD.