PatchRadar

← Browse

CVE-2026-44293

Medium

Elevated severity or exploit probability.

CVSS base
8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS — probability of exploitation (30 days)
0.7%
52.4th percentile
CISA KEV
Not listed
Weakness / dates
CWE-94
Published 2026-05-13 · modified 2026-09-09

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected

protobufjs_project

References

Official: NVD · CVE.org