protobufjs Prototype Pollution vulnerability

NGHIÊM TRỌNG 9.8CVE-2023-36665 · GHSA-h755-8qp9-cq85 · Công bố 05/07/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-36665 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng protobufjs (protobufjs project), protobufjs.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.7%, cao hơn 77.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.2.5, 6.11.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
protobufjs protobufjs_project	`≥ 6.10.0, < 7.2.5`	`7.2.5`
protobufjs npm	`≥ 6.10.0, < 6.11.4≥ 7.0.0, < 7.2.5`	`6.11.47.2.5`

Mô tả

protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about Object.constructor.prototype.<new-property> = ...; whereas CVE-2022-25878 was about Object.__proto__.<new-property> = ...; instead.

Mô tả của NVD

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.