4.8Mittel
CVE-2026-59876protobufjs: Text Format string map parsing can mutate returned map object prototype
Beschreibung
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
Schwachstellentyp (CWE):
CWE-1321
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| protobufjs | protobuf.js | >= 8.2.0, < 8.6.5 | |
| protobufjs project | protobufjs | 8.2.0 – < 8.6.5 |
Referenzen und Patches
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jfj6-75fj-8934 MitigationVendor Advisory
- https://github.com/protobufjs/protobuf.js/pull/2335 Issue TrackingPatch
- https://github.com/protobufjs/protobuf.js/commit/9f97fe413072d3beb52c74e62d88ea8adc9444d8 Patch
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.5 ProductRelease Notes
CPE-Treffer (NVD) (1)
cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*≥ 8.2.0 < 8.6.5