Protobuf.js unsafe toObject code injection before 7.5.6 & <8.0.2
CVE-2026-44293 Published on May 13, 2026

protobufjs: Code injection through bytes field defaults in generated toObject code
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

NVD

Vulnerability Analysis

CVE-2026-44293 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
HIGH

Weakness Type

What is a Code Injection Vulnerability?

The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CVE-2026-44293 has been classified to as a Code Injection vulnerability or weakness.


Products Associated with CVE-2026-44293

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Rhdh
 
Red Hat Service Mesh
 
Red Hat Ansible Automation Platform
 
Red Hat Podman Desktop
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Ai
 
Red Hat Openshift
 
Red Hat Openshift Data Foundation
 
Red Hat Ansible Portal
 
Red Hat Openshift Pipelines
 
Red Hat Hummingbird
 

Affected Versions

protobufjs protobuf.js: Red Hat Developer Hub 1.9: Red Hat OpenShift Service Mesh 3.3: Red Hat Ansible Automation Platform 2: Red Hat Build of Podman Desktop: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux AI (RHEL AI) 3: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat Self-service automation portal 2: Red Hat OpenShift Pipelines: Red Hat Enterprise Linux 8: Red Hat Hardened Images:

Exploit Probability

EPSS
0.29%
Percentile
20.92%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.