CVE-2026-44293 — protobufjs: Code injection through bytes field defaults in generated toObject code

Description (CNA)

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected (CNA)

Vendor / product	Versions
protobufjs / protobuf.js	affected < 7.5.6; affected >= 8.0.0, < 8.0.2

CWE

CWE-94

References

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in protobufjs, a library used to compile protobuf definitions into JavaScript functions. A remote attacker could exploit this vulnerability by providing a crafted descriptor that includes a non-string default value for a bytes field. This could lead to the generation of an unsafe expression within the toObject conversion function, ultimately allowing the attacker to execute arbitrary code.