Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44291

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If Object.prototype had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information. This could cause attacker-controlled strings to be emitted into generated JavaScript code. This vulnerabilit
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:dc35005618282289861ebe07cb850c3972714b0d542a0ba3751d9559f1b319da
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"protobuf.js","vendor":"protobufjs","versions":[{"status":"affected","version":"< 7.5.6"},{"status":"affected","version":">= 8.0.0, < 8.0.2"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:17eac49857acf5b2e330ab46a249c89958047dc511ec6347e12cfec02d5b625e · sha256:914d9f236ebd07fa… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:17eac49857acf5b2e330ab46a249c89958047dc511ec6347e12cfec02d5b625e · sha256:914d9f236ebd07fa… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:17eac49857acf5b2e330ab46a249c89958047dc511ec6347e12cfec02d5b625e · sha256:914d9f236ebd07fa… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:17eac49857acf5b2e330ab46a249c89958047dc511ec6347e12cfec02d5b625e · sha256:914d9f236ebd07fa… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer