GHSA-66ff-xgx4-vchm

protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function.

Impact

An attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.

This requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.

Preconditions

The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.
The descriptor must define a bytes field with an attacker-controlled default value.
The application must call toObject with defaults enabled for the affected type.

Workarounds

Do not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.

Database specific

{
    "github_reviewed_at": "2026-05-12T15:06:13Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

npm / protobufjs

Package

Name: protobufjs; View open source insights on deps.dev
Purl: pkg:npm/protobufjs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.5.6

Database specific

last_known_affected_version_range

"<= 7.5.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json"