{"id":"CVE-2026-44291","aliases":["GHSA-75px-5xx7-5xc7"],"url":"https://o3.security/vulnerability/CVE-2026-44291","summary":"protobufjs: Code generation gadget after prototype pollution","details":"## Summary\n\nprotobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If `Object.prototype` had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.\n\nThis could cause attacker-controlled strings to be emitted into generated JavaScript code.\n\n## Impact\n\nAn attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution.\n\nThis issue requires a separate prototype pollution primitive before protobufjs is invoked.\n\nApplications without a reachable prototype pollution primitive are not directly exploitable through this issue alone.\n\n## Preconditions\n\n- The application or one of its dependencies must allow an attacker to pollute `Object.prototype`.\n- The polluted property must affect protobufjs internal type lookup behavior.\n- The application must use protobufjs functionality that generates encode or decode code for affected types.\n- The generated code path must be reached after the prototype pollution has occurred.\n\n## Workarounds\n\nAvoid running affected versions in applications where attacker-controlled input can pollute `Object.prototype`. If immediate upgrade is not possible, remove or mitigate reachable prototype pollution primitives and isolate schema/message processing from untrusted application state.","published":"2026-05-13T14:42:13.984Z","modified":"2026-08-12T03:51:40.112201945Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.005,"percentile":0.40811,"asOf":"2026-09-01"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"protobufjs","fixedVersion":"7.5.6"},{"ecosystem":"npm","name":"protobufjs","fixedVersion":"8.0.2"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44291.json"},{"type":"ADVISORY","url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44291"},{"type":"PACKAGE","url":"https://github.com/protobufjs/protobuf.js"},{"type":"WEB","url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6"},{"type":"WEB","url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.112201945Z"}}