PT-2026-40539 · Npm · Protobufjs

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-44293

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 7.5.6 protobufjs versions prior to 8.0.2

Description JavaScript generated for toObject conversion may include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor containing a non-string default value for a bytes field can lead to the emission of attacker-controlled code into the generated conversion function. This allows an attacker who can influence a protobuf descriptor to execute arbitrary JavaScript within the process context, provided the application loads an untrusted schema and converts a message of the affected type with defaults enabled.

Recommendations Update to version 7.5.6. Update to version 8.0.2. Avoid loading protobuf schemas or JSON descriptors from untrusted sources. Validate or restrict field options before loading untrusted schemas and execute schema processing in an isolated environment.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-44293

GHSA-66FF-XGX4-VCHM

Affected Products

Protobufjs

References · 7

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66ff-xgx4-vchm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44293 · Security Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 · Note
• https://github.com/protobufjs/protobuf.js · Note
• https://t.me/CVEtracker/53657 · Telegram Post