CoreCVE
Back

HIGH

protobufjs: Code injection through bytes field defaults in generated toObject code

Published May 13, 2026

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

Affected products

Remediation

Red Hat statement

This is an Important flaw affecting Red Hat products that incorporate the protobufjs library. protobufjs is vulnerable to arbitrary code execution when compiling protobuf definitions into JavaScript. During generation of the toObject conversion function, a schema-controlled default value on a bytes field that is not a string can be emitted as unsafe JavaScript code. An attacker who can supply or influence the protobuf descriptor processed by the application (low privileges required) may achieve code execution in the Node.js process context. Fixed upstream in protobufjs 7.5.6 and 8.0.2. Affects Red Hat offerings that bundle protobufjs and process attacker-influenced protobuf schemas at runtime.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Weaknesses (1)

CWE-94

Code Injection

References (20)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published May 13, 2026
Updated Sep 9, 2026
Reserved May 5, 2026
Link CVE-2026-44293
CISA Vulnrichment
Updated May 14, 2026
NVD
Status Modified
Modified Sep 9, 2026
Link CVE-2026-44293
Red Hat
Severity Important
Public date May 13, 2026
Links CVE-2026-44293 - Bugzilla
GHSA-66FF-XGX4-VCHM