https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 06:25:25 +0000 https://vulnerability.circl.lu/vuln/ghsa-75px-5xx7-5xc7 <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If `Object.prototype` had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.</p> <p>This could cause attacker-controlled strings to be emitted into generated JavaScript code.</p> <p>## Impact</p> <p>An attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution.</p> <p>This issue requires a separate prototype pollution primitive before protobufjs is invoked.</p> <p>Applications without a reachable prototype pollution primitive are not directly exploitable through this issue alone.</p> <p>## Preconditions</p> <p>- The application or one of its dependencies must allow an attacker to pollute `Object.prototype`. - The polluted property must affect protobufjs internal type lookup behavior. - The application must use protobufjs functionality that generates encode or decode code for affected types. - The generated code path must be reached after the prototype pollution has occurred.</p> <p>## Workarounds</p> <p>Avoid running affected versions in applications where attacker-controlled input can pollute `Object.prototype`. If immediate upgrade is not possible, remove or mitigate reachable prototype pollution primitives and isolate schema/message processing from untrusted appli…</p> <p><strong>Affected:</strong> npm: protobufjs</p> <p>## Summary</p> <p>protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated encode and decode functions. If `Object.prototype` had already been polluted, those lookup tables could resolve attacker-controlled inherited properties as valid protobuf type information.</p> <p>This could cause attacker-controlled strings to be emitted into generated JavaScript code.</p> <p>## Impact</p> <p>An attacker who can first trigger a prototype pollution vulnerability may be able to influence generated protobufjs encode or decode functions in a way that can lead to arbitrary JavaScript execution.</p> <p>This issue requires a separate prototype pollution primitive before protobufjs is invoked.</p> <p>Applications without a reachable prototype pollution primitive are not directly exploitable through this issue alone.</p> <p>## Preconditions</p> <p>- The application or one of its dependencies must allow an attacker to pollute `Object.prototype`. - The polluted property must affect protobufjs internal type lookup behavior. - The application must use protobufjs functionality that generates encode or decode code for affected types. - The generated code path must be reached after the prototype pollution has occurred.</p> <p>## Workarounds</p> <p>Avoid running affected versions in applications where attacker-controlled input can pollute `Object.prototype`. If immediate upgrade is not possible, remove or mitigate reachable prototype pollution primitives and isolate schema/message processing from untrusted appli…</p> https://vulnerability.circl.lu/vuln/ghsa-75px-5xx7-5xc7