HIGH🇵🇱 Wersja polska

CVE-2026-44290

CVSS 7.5v3.1pub. 2026-05-13upd. 2026-05-14

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Protobufjs Project Protobufjs
APP
Protobufjs Project
< 7.5.68.0.0 – 8.0.2 (bez)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

References

github.com/protobufjs/protobuf.js/security/advisories/G…

Related vulnerabilities

CVE-2026-41242CRITICAL9.4PL ✓ten sam produkt

Wstrzykiwanie kodu w protobuf.js podczas dekodowania definicji

CVE-2023-36665CRITICAL9.8ten sam produkt

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerab...

CVE-2026-48712HIGH7.5ten sam produkt

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs ...

CVE-2026-44289HIGH7.5ten sam produkt

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs ...

CVE-2026-44291HIGH8.1ten sam produkt

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs ...