CVE-2026-44292

MEDIUM

protobufjs: Prototype injection in generated message constructors

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-44292. PoCs published by HORKimhab.

AI-analyzed exploit summary The repository contains no actual exploit code or technical details for CVE-2026-44292. It only includes a template README with generic setup instructions and a placeholder for CVE IDs.

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.

Exploits (1)

github STUB
by HORKimhab · poc
https://github.com/HORKimhab/CVE-2026-442_

The repository contains no actual exploit code or technical details for CVE-2026-44292. It only includes a template README with generic setup instructions and a placeholder for CVE IDs.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unspecified
No auth needed
Prerequisites: none
mistral-large-3 · analyzed Jun 10, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v3 5.3
EPSS 0.0026
EPSS Percentile 17.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1321
Status published
Products (5)
npm/protobufjs 0 - 7.5.6npm
npm/protobufjs 8.0.0 - 8.0.2npm
protobufjs/protobuf.js < 7.5.6
protobufjs/protobuf.js >= 8.0.0, < 8.0.2
protobufjs_project/protobufjs < 7.5.6
Published May 13, 2026
Tracked Since May 13, 2026