Описание
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the proto key. If an application constructed a message from an attacker-controlled plain object, an own enumerable proto property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
Ссылки
- MitigationVendor Advisory
Уязвимые конфигурации
Одно из
EPSS
5.3 Medium
CVSS3
Дефекты
Связанные уязвимости
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.
protobufjs compiles protobuf definitions into JavaScript (JS) function ...
protobuf.js: Prototype injection in generated message constructors
Уязвимость библиотеки для работы с протоколом Protocol Buffers (Protobuf) protobufjs, связанная с неконтролируемым изменением атрибутов прототипа объекта, позволяющая нарушителю повысить свои привилегии
EPSS
5.3 Medium
CVSS3