CVE-2026-44293

HIGH

protobufjs: Code injection through bytes field defaults in generated toObject code

Title source: cna
STIX 2.1

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

References (12)

Core 12
Core References

Scores

CVSS v3 8.8
EPSS 0.0039
EPSS Percentile 32.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (3)
protobufjs/protobuf.js < 7.5.6
protobufjs/protobuf.js >= 8.0.0, < 8.0.2
protobufjs_project/protobufjs < 7.5.6
Published May 13, 2026
Tracked Since May 13, 2026