Protocol Buffers Schema Parser
Monthly
Prototype pollution in mafintosh's protocol-buffers-schema 3.6.0 allows remote attackers to inject arbitrary properties into JavaScript objects by supplying a malicious protocol buffer schema definition to the parse function. This can lead to application logic manipulation, security check bypass, denial of service, or remote code execution. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV at this time.
Prototype pollution in mafintosh's protocol-buffers-schema 3.6.0 allows remote attackers to inject arbitrary properties into JavaScript objects by supplying a malicious protocol buffer schema definition to the parse function. This can lead to application logic manipulation, security check bypass, denial of service, or remote code execution. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV at this time.