protobuf.js: Code generation gadget after prototype pollution

🗓️ 12 May 2026 15:01:24Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 165 Views

Prototype pollution in protobufjs can corrupt encode/decode code via polluted prototypes.

Reporter	Title	Published	Views	Family All 177
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	20 May 202613:41	–	ibm
IBM Security Bulletins	Security Bulletin: Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294	16 Sep 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watsonx BI Assistant for CP4D affected by multiple CVEs	11 Aug 202619:07	–	ibm
attackerkb	CVE-2026-44291	13 May 202614:42	–	attackerkb
BDU FSTEC	The vulnerability of the JavaScript function in the Protocol Buffers (Protobuf) library called protobufjs, which allows a hacker to execute arbitrary code.	2 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-44291 vulnerabilities	13 May 202613:18	–	cgr
Circl	CVE-2026-44291	10 Jun 202609:00	–	circl
CNNVD	protobuf.js 代码注入漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-44291	13 May 202614:42	–	cve
Cvelist	CVE-2026-44291 protobufjs: Code generation gadget after prototype pollution	13 May 202614:42	–	cvelist

Vulners

Node

Source	Link
github	www.github.com/protobufjs/protobuf.js/security/advisories/GHSA-75px-5xx7-5xc7
github	www.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
github	www.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44291
github	www.github.com/advisories/GHSA-75px-5xx7-5xc7

14 May 2026 20:35Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.1

EPSS0.00421

SSVC