Junglewise Threat Intelligence

CVE-2026-44293: protobufjs code injection in toObject function generation

CVE-2026-44293 · Severity: high · CVSS 8.8 · Published 2026-05-13

Executive brief

protobufjs is a popular library used to handle data serialization in JavaScript applications. A security flaw allows an attacker to execute malicious code on a server if the application processes a specially crafted data schema from an untrusted source. This could lead to a full system compromise, unauthorized data access, or service disruption. Organizations should update to the latest versions of the library or affected Red Hat products immediately.

Technical details

A code injection vulnerability (CWE-94) exists in protobufjs due to improper sanitization of default values for 'bytes' fields during the generation of the 'toObject' conversion function. When the library compiles a protobuf descriptor into JavaScript, a non-string default value in a bytes field can cause the generator to emit unsafe expressions directly into the resulting function code. An attacker who can provide or influence a protobuf JSON descriptor or reflected schema can achieve arbitrary JavaScript execution in the context of the Node.js process. This exploit requires the application to load the malicious schema and call 'toObject' with defaults enabled. The issue is patched in versions 7.5.6 and 8.0.2.

Affected products

  • protobufjs protobuf.js < 7.5.6, >= 8.0.0 < 8.0.2
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 9

Timeline

  • 2026-05-12: advisory: GitHub Security Advisory published by maintainers
  • 2026-05-13: disclosed: NVD publication date
  • 2026-06-15: patched: Red Hat released security updates for OpenShift Service Mesh
  • 2026-06-16: patched: Red Hat released security updates for Developer Hub

References

Related threats