Количество 5
Количество 5
CVE-2026-44293
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVE-2026-44293
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVE-2026-44293
protobufjs compiles protobuf definitions into JavaScript (JS) function ...
GHSA-66ff-xgx4-vchm
protobuf.js: Code injection through bytes field defaults in generated toObject code
BDU:2026-09109
Уязвимость функции toObject() библиотеки для работы с протоколом Protocol Buffers (Protobuf) protobufjs, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-44293 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2. | CVSS3: 7.1 | 0% Низкий | 3 месяца назад |
 | CVE-2026-44293 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2. | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
| CVE-2026-44293 protobufjs compiles protobuf definitions into JavaScript (JS) function ... | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
| GHSA-66ff-xgx4-vchm protobuf.js: Code injection through bytes field defaults in generated toObject code | 0% Низкий | 3 месяца назад | |
 | BDU:2026-09109 Уязвимость функции toObject() библиотеки для работы с протоколом Protocol Buffers (Protobuf) protobufjs, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
Уязвимостей на страницу