CVE-2022-25878
CVE-2022-25878 · Prototype Pollution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
CVSS 8.2 · High · EPSS 2.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
protobufjs
- Versions
- ≥ unspecified, < 6.11.3: Affected (custom)
Update to 6.11.3
protobufjs npm
- Affected ranges
- SEMVER: ≥ 6.11.0, < 6.11.3
Update to 6.11.3
protobufjs npm
- Affected ranges
- SEMVER: ≥ 6.10.0, < 6.10.3
Update to 6.10.3
Original sources
- https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507
- https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197
- https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f
- https://github.com/protobufjs/protobuf.js/pull/1731
- https://nvd.nist.gov/vuln/detail/CVE-2022-25878