CVE-2026-44293 - Vulnerability Analysis

Overview

protobufjs < 7.5.6 and < 8.0.2 contains a code injection vulnerability caused by unsafe expression generation from schema-controlled bytes field default values, letting attackers inject code into generated toObject conversion functions, exploit requires crafted protobuf descriptors.

Severity & Score

Impact

Attackers can inject and execute arbitrary code in generated JavaScript functions, leading to remote code execution.

Mitigation

Update to version 7.5.6 or 8.0.2 or later.

References

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner