Executive brief
The protocol-buffers-schema library, a tool used to parse Protocol Buffer definitions in Node.js applications, is vulnerable to a security flaw called prototype pollution. By providing a specially crafted schema file, an attacker can inject malicious properties into the core JavaScript environment of the application. This can lead to a variety of serious issues, including bypassing security checks, crashing the service, or potentially taking full control of the server.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the 'parse.js' component of the protocol-buffers-schema library. The parser uses a 'reduce' function to traverse path components within field options (e.g., [(foo).bar = "value"]) without sanitizing dangerous keys. An attacker can use the '__proto__' key within a .proto schema definition to traverse to and modify the global Object.prototype. This allows for arbitrary property injection across the entire Node.js process. Successful exploitation can be used as a primitive for authentication bypass, denial of service, or remote code execution depending on available gadgets in the application environment. The issue is fixed in version 3.6.1 by utilizing null-prototype objects for data structures.
Affected products
- Mafintosh protocol-buffers-schema < 3.6.1
Timeline
- 2026-03-10: other: Vulnerability reported via GitHub Pull Request
- 2026-04-06: patched: Fix merged into master branch
- 2026-04-12: disclosed: Detailed research blog post published
- 2026-04-15: advisory: GitHub Advisory and CVE published