CVE-2026-44292

5.3 Moyenne

Publiée le 13/05/2026 à 18:16 · Modifiée le 17/06/2026 à 12:50 · Analysée par le NVD · Source : security-advisories@github.com

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.

Traduire en français

Produits concernés

protobufjs protobuf.js
Protobufjs project protobufjs

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-1321

Références

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w MitigationVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories