Loading story…
A vulnerability in the npm package protobufjs allows arbitrary JavaScript execution when an application processes attacker-controlled protobuf definition files. The flaw, tracked as GHSA-xq3m-2v4x-88gg, stems from unsafe handling of protobuf type fields, which can be compiled into executable JavaScript and triggered during object decoding, creating a path to remote code execution in affected deployments.
The issue affects protobufjs versions up to 8.0.0 and 7.5.4, and has been fixed in 8.0.1 and 7.5.5. A published proof of concept shows a malicious JSON descriptor invoking Node.js child_process during decode, underscoring the risk for applications that ingest untrusted schema or descriptor data. Organizations using protobufjs should upgrade to the patched releases and review whether external parties can supply protobuf definitions.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability was reported as fixed in protobufjs versions 8.0.1 and 7.5.5. These releases address the remote code execution risk when applications process attacker-controlled protobuf definition files.
A GitHub security advisory disclosed that protobufjs contains an arbitrary JavaScript execution vulnerability caused by attacker-controlled protobuf "type" fields being compiled into executable code during decoding. The issue affects versions up to 8.0.0 and up to 7.5.4, and the advisory included a proof of concept showing code execution via a malicious JSON descriptor.
Endor Labs reported the protobuf.js remote code execution vulnerability to the project maintainers. The flaw involved unsafe dynamic JavaScript generation from untrusted schema names, enabling code execution when crafted .proto or JSON schema files were processed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
9 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourceinfosec.pub
Open sourcebleepingcomputer.com
Open sourcecvereports.com
Open sourcesecurityonline.info
Open sourceendorlabs.com
Open sourceresearch.averlon.ai
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed six vulnerabilities, dubbed **Proto6**, in the widely used `protobuf.js` ecosystem that can enable **remote code execution**, **denial of service**, **prototype pollution**, and **prototype injection** in affected Node.js environments. The most severe flaw, `CVE-2026-44291`, allows arbitrary JavaScript execution through prototype pollution combined with unsafe code-generation behavior, while other issues involve recursion-based crashes, unsafe schema option path handling, crafted field-name abuse, and code injection in `pbjs` static output. The bugs affect applications and build pipelines that deserialize Protocol Buffers data or generate code from schemas using `protobuf.js`, including Google Cloud client libraries, gRPC-related tooling, messaging frameworks such as Baileys, and CI/CD workflows. Researchers said the library is deeply embedded across the JavaScript ecosystem, with more than 50 million weekly downloads and frequent transitive inclusion that can make exposure hard to identify. Fixed versions are available in `protobufjs` `7.5.6` and `8.0.2`, and in `protobufjs-cli` `1.2.1` and `2.0.2`; vulnerable releases include `protobuf.js` through `7.5.5` and `8.0.0`-`8.0.1`, and `protobufjs-cli` through `1.2.0` and `2.0.0`-`2.0.1`.
Jun 29, 2026
Two high-severity flaws were disclosed in widely used JavaScript libraries, exposing applications to sandbox bypass and arbitrary code execution. **CVE-2026-34208** affects SandboxJS before `0.8.36` and allows attacker-supplied code to evade protections on direct assignment to global objects by abusing an exposed constructor path. The bypass uses `this.constructor.call(target, attackerObject)` to reach the internal `SandboxGlobal` function while `Function.prototype.call` remains permitted, enabling arbitrary properties to be written into host global objects and persist across sandbox instances in the same process. A separate issue, **CVE-2026-41242**, impacts `protobufjs` before `8.0.1` and `7.5.5`, where attackers can inject arbitrary code into Protocol Buffers definition `type` fields and trigger execution during object decoding with a malicious schema. The flaw is tracked as **CWE-94** and carries a CVSS v4 rating reflecting network-reachable exploitation with high impact to confidentiality, integrity, availability, and downstream systems. Maintainers released fixes in SandboxJS `0.8.36` and protobufjs `8.0.1` and `7.5.5`.
Jun 29, 2026
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026