CVE-2026-44293: protobufjs: Code injection through bytes field defaults in generated toObject code
Vulnerability summary
CVE-2026-44293 is a high (CVSS 8.8) Improper Control of Generation of Code vulnerability in protobufjs_project protobufjs. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35% of scored vulnerabilities.
Not severe (CVSS 7.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.
CVSS metrics
7 scores · 5 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVE.orgCNA7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:HDiffers
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
Decrease -0.33 pp
From 0.73% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard25 products
- cadence-web< 4.0.15-r2
- gemini-cli< 0.44.0-r0
- homepage< 1.13.1-r3
- kibana-8.19< 8.19.15-r0
- kibana-8.19-bitnami< 8.19.15-r0
Wolfi4 products
- kubeflow-centraldashboard< 1.10.0-r21
- pulumi-language-nodejs< 3.237.0-r1
- renovate< 43.170.15-r2
- vitess-23< 23.0.4-r5
Npm1 product
- protobufjs< 7.5.6 | ≥ 8.0.0, < 8.0.2
Protobufjs1 product
- protobuf.js< 7.5.6 | ≥ 8.0.0, < 8.0.2
Protobufjs_project1 product
- protobufjs< 7.5.6 | ≥ 8.0.0, < 8.0.2
5 vendors · 32 products
References
20 links- github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchmX Refsource CONFIRMAdvisoryWEBMitigationVendor Advisory
