CVE-2026-44291

Katalog CVE

CVSS 8.1 · High EPSS 0,42%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada protobufjs project protobufjs. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerability is fixed in 7.5.6 and 8.0.2.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7 mitigasi · advisory vendor