Code Injection in protobuf.js - CVE-2026-44293
Published: May 12, 2026
Vulnerability identifier: #VU131160
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-44293
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper control of code generation in generated toObject code when processing an attacker-controlled protobuf descriptor with a non-string default value for a bytes field and converting a message with defaults enabled. A remote user can provide a crafted descriptor to execute arbitrary code.
Exploitation requires the application to load an attacker-controlled schema or descriptor and call toObject with defaults enabled for the affected type.
Affected software
protobuf.js
Red Hat OpenShift Container Platform
Red Hat OpenShift Container Platform
How to mitigate CVE-2026-44293
Install security update from vendor's website.
protobuf.js - addressed in versions 7.5.6, 8.0.2
Red Hat OpenShift Container Platform - addressed in versions 4.20.29, 4.21.24, 4.22.3
Red Hat OpenShift Container Platform - addressed in versions 4.20.29, 4.21.24, 4.22.3