protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function.
An attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.
This requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.
bytes field with an attacker-controlled default value.toObject with defaults enabled for the affected type.Do not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.
| Score | Percentile |
|---|---|
| 0.05% | 16.19% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 7.7 | 4.0 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-66ff-xgx4-vchm ↗ |
| CVE | CVE-2026-44293 ↗ |
| CWE id | Name |
|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | protobufjs | <= 7.5.5 | 7.5.6 | — |
| npm | protobufjs | >= 8.0.0, <= 8.0.1 | 8.0.2 | — |