The vulnerability arises from prototype pollution when the TOON decoder processes attacker‑controlled keys such as __proto__, constructor, or prototype. Instead of creating a new property, the decoder writes onto the Object prototype, allowing an attacker to inject arbitrary properties into all objects created thereafter. If a downstream gadget chain is present, this can lead to remote code execution; otherwise, the polluted prototype can cause application failure or denial of service.

Any installation of toon-format TOON older than version 2.3.1 that accepts untrusted TOON data is affected. This includes projects that import the package directly or use it via a dependency chain.

The CVSS score of 8.3 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, but the potential for remote code execution is significant. The attack vector is decoding untrusted TOON data, which can be delivered over a network or injected into a local service, making the vulnerability exploitable remotely if the service processes external input.