Skip to content

[GHSA-66ff-xgx4-vchm] protobuf.js: Code injection through bytes field defaults in generated toObject code #7689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tijuks wants to merge 2 commits into
base: tijuks/advisory-improvement-7689
Choose a base branch
from
+7 −5
Open

[GHSA-66ff-xgx4-vchm] protobuf.js: Code injection through bytes field defaults in generated toObject code #7689

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d5e350
Improve GHSA-66ff-xgx4-vchm
tijuks May 14, 2026
35aa79b
Improve GHSA-66ff-xgx4-vchm
tijuks May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-66ff-xgx4-vchm",
"modified": "2026-05-12T15:06:13Z",
"modified": "2026-05-12T15:06:15Z",
"published": "2026-05-12T15:06:13Z",
"aliases": [
"CVE-2026-44293"
],
"summary": "protobuf.js: Code injection through bytes field defaults in generated toObject code",
"summary": "Improper Control of Generation of Code ('Code Injection') and Improper Verification of Source of a Communication Channel and Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in protobufjs",
"details": "## Summary\n\nprotobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a schema-controlled `bytes` field default value. A crafted descriptor with a non-string default value for a `bytes` field could cause attacker-controlled code to be emitted into the generated conversion function.\n\n## Impact\n\nAn attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.\n- The descriptor must define a `bytes` field with an attacker-controlled default value.\n- The application must call `toObject` with defaults enabled for the affected type.\n\n## Workarounds\n\nDo not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:H/SI:N/SA:H"
}
],
"affected": [
Expand Down Expand Up @@ -80,9 +80,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
"CWE-90",
"CWE-94",
"CWE-940"
],
"severity": "HIGH",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-05-12T15:06:13Z",
"nvd_published_at": null
Expand Down