{"vulnerability": "cve-2026-8240", "sightings": [{"uuid": "beaf2fd5-25c2-4962-bc75-93e1bee65f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82404", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mukjbhhcji2a", "content": "\ud83d\udfe0 CVE-2026-82404 - High (8.3)\n\nTOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, dec...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-82404/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-02T18:00:18.936418Z"}, {"uuid": "24cb808c-141e-46af-b1d0-a851cc85025b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82404", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/d72zrvwkyefas", "content": "CVE-2026-82404 - TOON Prototype Pollution Vulnerability\nCVE ID : CVE-2026-82404\n \n Published : Sept. 2, 2026, 5:18 p.m. | 47\u00a0minutes ago\n \n Description : TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled ...", "creation_timestamp": "2026-09-02T19:00:26.296273Z"}, {"uuid": "5fa67d74-2c80-4226-a8cb-d91f2d3fa433", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82404", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mund7xigda2r", "content": "Decoding untrusted TOON input polluted Object.prototype: @toon-format/toon wrote a `__proto__`, `constructor` or `prototype` key through the prototype chain instead of creating an own property. CVE-2026-82404, high. Dotted keys under `expandPaths: 'safe'` were the strongest vector. #dev", "creation_timestamp": "2026-09-03T20:50:05.398732Z"}, {"uuid": "2bf97ac9-109e-4557-8fee-a669281ba893", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-82405", "type": "seen", "source": "https://gist.github.com/alon710/5f3098f0ef594e678313ac3cea1fd61f", "content": "# CVE-2026-82405: CVE-2026-82405: Incorrect Authorization leading to Account Takeover in klever-go\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-82405\n\n## Summary\nA critical incorrect authorization vulnerability (CWE-863) exists in the Go implementation of the Klever blockchain protocol (klever-go) prior to version 1.7.20. The vulnerability allows an attacker to completely replace a target account's permission set by manipulating the RecipientAddr parameter in a VM built-in function, leading to total account takeover.\n\n## TL;DR\nAn incorrect authorization flaw in klever-go < 1.7.20 allows attackers to overwrite any account's permission set using a malicious contract call, resulting in unauthorized account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7 (High)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v1.7.20\n\n## Affected Systems\n\n- klever-go\n- **klever-go**: < 1.7.20 (Fixed in: `1.7.20`)\n\n## Mitigation\n\n- Upgrade all running node implementations of klever-go to version 1.7.20 or later.\n- Verify that all custom blockchain integrations pass cryptographically validated caller addresses to permission endpoints.\n- Monitor on-chain events for unexpected UpdatePermission contract executions.\n\n**Remediation Steps:**\n1. Download the patched release of klever-go (version 1.7.20) from the official GitHub repository.\n2. Compile the node binary using Go and deploy it to validator and public node hosts.\n3. Verify the version output of the running daemon to confirm the patch is active.\n4. Conduct a state-level audit of registered permissions to identify any unauthorized self-signing modification events.\n\n## References\n\n- [GHSA-97cv-x867-6xhm Security Advisory](https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm)\n- [Fix Commit on GitHub](https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32)\n- [Technical Proof of Concept](https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9)\n- [Klever Go v1.7.20 Release Tag](https://github.com/klever-io/klever-go/releases/tag/v1.7.20)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-82405) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T20:32:15.205352Z"}, {"uuid": "d6cc9c4a-4ff2-4ab4-bd42-01b138d735e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82405", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm", "content": "", "creation_timestamp": "2026-09-23T20:35:02.647584Z"}, {"uuid": "2f13d690-3900-4bc5-ae56-dfbedaa7e3d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82407", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688", "content": "", "creation_timestamp": "2026-09-23T22:35:33.278043Z"}, {"uuid": "e75b1c06-c00e-4e8f-8f8a-cde46e55f952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82409", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj", "content": "", "creation_timestamp": "2026-09-23T22:35:36.200812Z"}, {"uuid": "3dc32ae1-4169-469e-ba27-4bf6168ac939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-82406", "type": "published-proof-of-concept", "source": "https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c", "content": "", "creation_timestamp": "2026-09-23T22:35:37.759049Z"}]}