PT-2026-40537 · Npm · Protobufjs
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
protobufjs versions prior to 7.5.6
protobufjs versions prior to 8.0.2
Description
protobufjs uses plain objects with inherited prototypes for internal type lookup tables within generated encode and decode functions. If
Object.prototype is polluted, these lookup tables may resolve attacker-controlled inherited properties as valid protobuf type information, potentially causing attacker-controlled strings to be emitted into generated JavaScript code. This can lead to arbitrary JavaScript execution if an attacker can first trigger a prototype pollution vulnerability. Prototype pollution is a technique where an attacker manipulates the prototype of a base object to inject properties that are inherited by other objects.Recommendations
Update to version 7.5.6.
Update to version 8.0.2.
Remove or mitigate reachable prototype pollution primitives and isolate schema or message processing from untrusted application state.
Exploit
Fix
Code Injection
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Protobufjs