[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-44293":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":62,"aliases":63,"duplicate_of":9,"upstream":65,"downstream":66,"duplicates":71,"related":72,"reserved_at":9,"published_at":75,"modified_at":76,"state":77,"summary":78,"references_raw":87,"kevs":159,"epss":160,"epss_history":163,"metrics":324,"affected":343},"CVE-2026-44293","protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-94","Improper Control of Generation of Code ('Code Injection')","The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","weakness","Draft","Base","Medium",[20,24,58],{"id":21,"name":22,"techniques":23},"CAPEC-242","Code Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[28,39,46],{"id":29,"name":30,"tactics":31,"countermeasures":38},"T1027.006","HTML Smuggling",[32,35],{"id":33,"name":34},"TA0030","Defense Evasion",{"id":36,"name":37},"TA0005","Stealth",[],{"id":40,"name":41,"tactics":42,"countermeasures":45},"T1027.009","Embedded Payloads",[43,44],{"id":33,"name":34},{"id":36,"name":37},[],{"id":47,"name":48,"tactics":49,"countermeasures":52},"T1564.009","Resource Forking",[50,51],{"id":33,"name":34},{"id":36,"name":37},[53],{"id":54,"name":55,"tactic":56},"D3-FFV","File Format Verification",{"name":57},"Isolate",{"id":59,"name":60,"techniques":61},"CAPEC-77","Manipulating User-Controlled Variables",[],[],[64],"GHSA-66ff-xgx4-vchm",[],[67,69],{"_key":68},"RHSA-2026:34160",{"_key":70},"RHSA-2026:37385",[],[73],{"_key":74},"CGA-GPHC-6Q2H-WQ5R","2026-05-13T14:43:33.342Z","2026-07-22T12:08:42.954Z","Analyzed",{"cisa_kev":79,"cisa_ransomware":79,"cisa_vendor":9,"epss_severity":80,"epss_score":81,"severity":82,"severity_score":83,"severity_version":84,"severity_source":85,"severity_vector":86,"severity_status":77},false,"low",0.00381,"high",8.8,"v3.1","nvd","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[88,98,103,107,111,117,122,127,131,135,139,143,147,151,155],{"url":89,"sources":90,"tags":93},"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm",[91,92,85],"osv_npm","cve.org",[94,95,96,97],"WEB","X Refsource CONFIRM","Vendor Advisory","Mitigation",{"url":99,"sources":100,"tags":101},"https://github.com/protobufjs/protobuf.js",[91],[102],"PACKAGE",{"url":104,"sources":105,"tags":106},"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6",[91],[94],{"url":108,"sources":109,"tags":110},"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2",[91],[94],{"url":112,"sources":113,"tags":114},"https://access.redhat.com/security/cve/CVE-2026-44293",[92],[115,116],"VDB Entry","X Refsource REDHAT",{"url":118,"sources":119,"tags":120},"https://bugzilla.redhat.com/show_bug.cgi?id=2477104",[92],[121,116],"Issue Tracking",{"url":123,"sources":124,"tags":125},"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44293.json",[92],[126],"X Sadp Csaf Vex",{"url":128,"sources":129,"tags":130},"https://access.redhat.com/errata/RHSA-2026:26234",[92],[96,116],{"url":132,"sources":133,"tags":134},"https://access.redhat.com/errata/RHSA-2026:26090",[92],[96,116],{"url":136,"sources":137,"tags":138},"https://access.redhat.com/errata/RHSA-2026:34160",[92],[96,116],{"url":140,"sources":141,"tags":142},"https://access.redhat.com/errata/RHSA-2026:34374",[92],[96,116],{"url":144,"sources":145,"tags":146},"https://access.redhat.com/errata/RHSA-2026:29795",[92],[96,116],{"url":148,"sources":149,"tags":150},"https://access.redhat.com/errata/RHSA-2026:37385",[92],[96,116],{"url":152,"sources":153,"tags":154},"https://access.redhat.com/errata/RHSA-2026:37186",[92],[96,116],{"url":156,"sources":157,"tags":158},"https://access.redhat.com/errata/RHSA-2026:37628",[92],[96,116],[],{"date":161,"score":81,"percentile":162},"2026-07-05",0.30125,[164,168,171,174,177,180,184,187,190,193,196,199,202,205,207,210,213,216,219,222,225,227,230,233,236,239,242,245,248,251,254,257,261,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,311,314,318,321,323],{"date":165,"score":166,"percentile":167},"2026-05-14",0.00052,0.16194,{"date":169,"score":166,"percentile":170},"2026-05-15",0.16207,{"date":172,"score":166,"percentile":173},"2026-05-16",0.16221,{"date":175,"score":166,"percentile":176},"2026-05-17",0.16199,{"date":178,"score":166,"percentile":179},"2026-05-18",0.16151,{"date":181,"score":182,"percentile":183},"2026-05-19",0.00058,0.18018,{"date":185,"score":182,"percentile":186},"2026-05-20",0.18032,{"date":188,"score":182,"percentile":189},"2026-05-21",0.18016,{"date":191,"score":182,"percentile":192},"2026-05-22",0.18148,{"date":194,"score":182,"percentile":195},"2026-05-23",0.18135,{"date":197,"score":182,"percentile":198},"2026-05-24",0.18088,{"date":200,"score":182,"percentile":201},"2026-05-25",0.18063,{"date":203,"score":182,"percentile":204},"2026-05-26",0.18055,{"date":206,"score":182,"percentile":192},"2026-05-27",{"date":208,"score":182,"percentile":209},"2026-05-28",0.18291,{"date":211,"score":182,"percentile":212},"2026-05-29",0.18355,{"date":214,"score":182,"percentile":215},"2026-05-30",0.18349,{"date":217,"score":182,"percentile":218},"2026-05-31",0.18342,{"date":220,"score":182,"percentile":221},"2026-06-01",0.18327,{"date":223,"score":182,"percentile":224},"2026-06-02",0.18331,{"date":226,"score":182,"percentile":224},"2026-06-03",{"date":228,"score":182,"percentile":229},"2026-06-04",0.18346,{"date":231,"score":182,"percentile":232},"2026-06-05",0.18424,{"date":234,"score":182,"percentile":235},"2026-06-06",0.18427,{"date":237,"score":182,"percentile":238},"2026-06-07",0.18389,{"date":240,"score":182,"percentile":241},"2026-06-08",0.18316,{"date":243,"score":182,"percentile":244},"2026-06-09",0.18336,{"date":246,"score":182,"percentile":247},"2026-06-10",0.18381,{"date":249,"score":182,"percentile":250},"2026-06-11",0.18417,{"date":252,"score":182,"percentile":253},"2026-06-12",0.18582,{"date":255,"score":182,"percentile":256},"2026-06-13",0.18599,{"date":258,"score":259,"percentile":260},"2026-06-14",0.00067,0.21003,{"date":262,"score":263,"percentile":264},"2026-06-15",0.00294,0.2088,{"date":266,"score":263,"percentile":267},"2026-06-16",0.20909,{"date":269,"score":263,"percentile":270},"2026-06-17",0.20913,{"date":272,"score":263,"percentile":273},"2026-06-18",0.20925,{"date":275,"score":263,"percentile":276},"2026-06-19",0.20916,{"date":278,"score":263,"percentile":279},"2026-06-20",0.20904,{"date":281,"score":263,"percentile":282},"2026-06-21",0.20891,{"date":284,"score":263,"percentile":285},"2026-06-22",0.20863,{"date":287,"score":263,"percentile":288},"2026-06-23",0.20927,{"date":290,"score":263,"percentile":291},"2026-06-24",0.20955,{"date":293,"score":263,"percentile":294},"2026-06-25",0.21052,{"date":296,"score":263,"percentile":297},"2026-06-26",0.21084,{"date":299,"score":263,"percentile":300},"2026-06-27",0.21132,{"date":302,"score":263,"percentile":303},"2026-06-28",0.21102,{"date":305,"score":263,"percentile":306},"2026-06-29",0.21103,{"date":308,"score":309,"percentile":310},"2026-06-30",0.00321,0.23789,{"date":312,"score":309,"percentile":313},"2026-07-01",0.239,{"date":315,"score":316,"percentile":317},"2026-07-02",0.00328,0.24695,{"date":319,"score":81,"percentile":320},"2026-07-03",0.30112,{"date":322,"score":81,"percentile":320},"2026-07-04",{"date":161,"score":81,"percentile":162},[325,329,337],{"source":91,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":326},{"baseScore":327,"baseSeverity":9,"vectorString":328,"impactScore":9,"exploitabilityScore":9},7.7,"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",{"source":92,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":330,"cvss_v4_0":336},{"baseScore":331,"baseSeverity":332,"vectorString":333,"impactScore":334,"exploitabilityScore":335},7.1,"HIGH","CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",9.2,4.1,{"baseScore":327,"baseSeverity":332,"vectorString":328,"impactScore":9,"exploitabilityScore":9},{"source":85,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":338,"cvss_v4_0":341},{"baseScore":83,"baseSeverity":332,"vectorString":86,"impactScore":339,"exploitabilityScore":340},9.8,7.2,{"baseScore":327,"baseSeverity":332,"vectorString":342,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[344,360,369],{"ecosystem":345,"name":346,"vendor":345,"product":346,"cpe_part":9,"purl_type":347,"purl_namespace":9,"purl_name":346,"source":9,"versions":348},"Npm","protobufjs","npm",[349,355],{"version":350,"is_range":351,"range_type":352,"version_start":9,"version_start_type":9,"version_end":353,"version_end_type":354,"fixed_in":9},"lt7_5_6",true,"semver","7.5.6","excluding",{"version":356,"is_range":351,"range_type":352,"version_start":357,"version_start_type":358,"version_end":359,"version_end_type":354,"fixed_in":9},"gte8_0_0_lt8_0_2","8.0.0","including","8.0.2",{"ecosystem":9,"name":346,"vendor":361,"product":346,"cpe_part":362,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":363},"protobufjs_project","a",[364,367],{"version":365,"is_range":351,"range_type":366,"version_start":9,"version_start_type":9,"version_end":353,"version_end_type":354,"fixed_in":9},"lt7.5.6","cpe",{"version":368,"is_range":351,"range_type":366,"version_start":357,"version_start_type":358,"version_end":359,"version_end_type":354,"fixed_in":9},"gte8.0.0_lt8.0.2",{"ecosystem":9,"name":370,"vendor":346,"product":370,"cpe_part":362,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":371},"protobuf.js",[372,374],{"version":373,"is_range":351,"range_type":92,"version_start":9,"version_start_type":9,"version_end":353,"version_end_type":354,"fixed_in":9},"\u003C 7.5.6",{"version":375,"is_range":351,"range_type":92,"version_start":357,"version_start_type":358,"version_end":359,"version_end_type":354,"fixed_in":9},">= 8.0.0, \u003C 8.0.2"]