Executive brief
protobufjs is a popular library used to handle data serialization in JavaScript applications. A vulnerability exists where the library can be tricked into executing malicious code if an attacker has already compromised the application's environment through a separate 'prototype pollution' flaw. This could allow an attacker to take full control of the application, potentially leading to data theft or service disruption.
Technical details
A code injection vulnerability (CWE-94) exists in protobufjs due to the use of plain objects with inherited prototypes for internal type lookup tables. When the library generates JavaScript functions for encoding or decoding protobuf definitions, it references these lookup tables. If an attacker has already successfully performed a prototype pollution attack on the global Object.prototype, they can inject malicious strings into these tables. These strings are then emitted directly into the generated JavaScript code, leading to arbitrary code execution. Exploitation requires a pre-existing prototype pollution primitive in the application or its dependencies. The issue is resolved in versions 7.5.6 and 8.0.2.
Affected products
- protobufjs protobufjs <= 7.5.5, >= 8.0.0, <= 8.0.1
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published by maintainers.
- 2026-05-13: disclosed: NVD publication date.
- 2026-05-13: patched: Fixes released in versions 7.5.6 and 8.0.2.