CVE-2026-5758

Отчет

Red Hat rates this flaw as Moderate. protocol-buffers-schema is a library and does not run on its own, as such, it requires an application to call it and utilize the vulnerable parsing functionality. When the pollution occurs, that application may read whatever malicious property was injected by the attacker, but then has to make a security-relevant decision (ex. granting access, spawning a process, etc.) and do it without checking whether the property actually belongs to the object or was inherited. As such, the impact of this vulnerability is entirely determined by what else is running in the process that calls the library along with what what permissions and checks it has, making the worst-case scenario of RCE only possible if that process is itself vulnerable.

Меры по смягчению последствий

If using protocol-buffers-schema, perform the following checks to help mitigate the impact of this vulnerability:

1. Do not parse .proto files from untrusted or semi-trusted sources (ex. user uploads, external repos, third-party APIs, etc.).
2. Audit downstream code for prototype pollution gadgets (ex. template engines, ORM configs, HTTP frameworks).
3. Consider freezing Object.prototype in security-sensitive contexts as a defense-in-depth measure (ex. Object.freeze(Object.prototype);). If maintaining a parser or config loader:
4. Never use reduce or bracket notation to walk user-controlled paths without filtering dangerous keys.
5. Block __proto__, constructor, and prototype explicitly in any path traversal logic.
6. Add negative test cases to verify that prototype pollution does not occur.