{"id":"CVE-2026-44293","aliases":["CLSA-2026-1784250508","CLSA-2026-1785468075","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1791362263","CLSA-2026-1792184156","CLSA-2026-1792490720","CLSA-2026-1792755967","EUVD-2026-30031","GHSA-66ff-xgx4-vchm","RHSA-2026:34160","RHSA-2026:37385","ROOT-APP-NPM-CVE-2026-44293"],"status":"published","title":"protobufjs: Code injection through bytes field defaults in generated toObject code","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00407,"percentile":0.353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2026-05-12T15:06:13Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["7.5.6","8.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["6.11.2-aikido.1","7.4.0-aikido.3","7.5.5-aikido.3","7.5.4-aikido.4","8.0.1-aikido.4","6.11.4-aikido.2","6.11.6-aikido.2","7.5.5-aikido.4","7.5.4-aikido.5","8.0.1-aikido.5","7.4.0-aikido.4","8.0.1-aikido.6","7.5.4-aikido.6","7.4.0-aikido.5","7.4.0-aikido.6","6.11.4-aikido.3","6.11.6-aikido.3","6.11.6-aikido.4","6.11.4-aikido.4","6.11.6-aikido.5","7.5.5-aikido.5","8.0.1-aikido.7","7.5.4-aikido.7","7.4.0-aikido.7","7.5.5-aikido.6","8.0.1-aikido.8","7.5.4-aikido.8","6.11.4-aikido.5","7.5.5-aikido.7","8.0.1-aikido.9","6.11.6-aikido.6","7.5.5-aikido.8","7.5.3-aikido.1","7.2.0-aikido.3","7.3.2-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["7.4.0-root.io.2","7.5.5-root.io.1","7.5.4-root.io.2","8.0.1-root.io.2","7.5.4-root.io.3","7.5.5-root.io.2","8.0.1-root.io.3","6.11.4-root.io.1","6.11.6-root.io.1","6.11.2-root.io.1","7.4.0-root.io.3","7.5.5-root.io.3","7.5.4-root.io.4","8.0.1-root.io.4","6.11.4-root.io.2","6.11.6-root.io.2","7.5.5-root.io.4","7.5.4-root.io.5","8.0.1-root.io.5","7.4.0-root.io.4","8.0.1-root.io.6","7.5.4-root.io.6","7.4.0-root.io.5","7.4.0-root.io.6","6.11.4-root.io.3","6.11.6-root.io.3","6.11.6-root.io.4","6.11.4-root.io.4","6.11.6-root.io.5","7.5.5-root.io.5","8.0.1-root.io.7","7.5.4-root.io.7","7.4.0-root.io.7","7.5.5-root.io.6","8.0.1-root.io.8","7.5.4-root.io.8","6.11.4-root.io.5","7.5.5-root.io.7","8.0.1-root.io.9","6.11.6-root.io.6","7.5.5-root.io.8","7.5.3-root.io.1","7.2.0-root.io.3","7.3.2-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"7.5.5"},{"fixed":"7.5.6"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.1"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.4"}]}],"versions":["6.11.6","6.11.6-tuxcare.1","6.11.6-tuxcare.2","6.11.6-tuxcare.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.1-tuxcare.0"},{"fixed":"8.0.1-tuxcare.1"}]}],"versions":["8.0.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.2"}]}],"versions":["6.11.3","6.11.3-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.3"}]}],"versions":["7.5.4","7.5.4-tuxcare.1","7.5.4-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.5.6"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-platform-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.10-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.7.13-2.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pysequoia-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.34-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt+crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.6::el9","package":"python3.12-pyjwt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-1.el9ap"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"rh-podman-desktop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-aikido.1"},{"fixed":"7.4.0-aikido.3"},{"fixed":"7.5.5-aikido.3"},{"fixed":"7.5.4-aikido.4"},{"fixed":"8.0.1-aikido.4"},{"fixed":"6.11.4-aikido.2"},{"fixed":"6.11.6-aikido.2"},{"fixed":"7.5.5-aikido.4"},{"fixed":"7.5.4-aikido.5"},{"fixed":"8.0.1-aikido.5"},{"fixed":"7.4.0-aikido.4"},{"fixed":"8.0.1-aikido.6"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.5"},{"fixed":"7.4.0-aikido.6"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.6-aikido.3"},{"fixed":"6.11.6-aikido.4"},{"fixed":"6.11.4-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.1-aikido.8"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"7.5.5-aikido.7"},{"fixed":"8.0.1-aikido.9"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"},{"fixed":"7.5.3-aikido.1"},{"fixed":"7.2.0-aikido.3"},{"fixed":"7.3.2-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-root.io.2"},{"fixed":"7.5.5-root.io.1"},{"fixed":"7.5.4-root.io.2"},{"fixed":"8.0.1-root.io.2"},{"fixed":"7.5.4-root.io.3"},{"fixed":"7.5.5-root.io.2"},{"fixed":"8.0.1-root.io.3"},{"fixed":"6.11.4-root.io.1"},{"fixed":"6.11.6-root.io.1"},{"fixed":"6.11.2-root.io.1"},{"fixed":"7.4.0-root.io.3"},{"fixed":"7.5.5-root.io.3"},{"fixed":"7.5.4-root.io.4"},{"fixed":"8.0.1-root.io.4"},{"fixed":"6.11.4-root.io.2"},{"fixed":"6.11.6-root.io.2"},{"fixed":"7.5.5-root.io.4"},{"fixed":"7.5.4-root.io.5"},{"fixed":"8.0.1-root.io.5"},{"fixed":"7.4.0-root.io.4"},{"fixed":"8.0.1-root.io.6"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.5"},{"fixed":"7.4.0-root.io.6"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.6-root.io.3"},{"fixed":"6.11.6-root.io.4"},{"fixed":"6.11.4-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.1-root.io.8"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"7.5.5-root.io.7"},{"fixed":"8.0.1-root.io.9"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"},{"fixed":"7.5.3-root.io.1"},{"fixed":"7.2.0-root.io.3"},{"fixed":"7.3.2-root.io.2"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6"},{"vendor":"red hat","product":"red hat ansible automation platform 2.6 for rhel 9"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"red hat","product":"red hat openshift container platform 4.22"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift service mesh 3.3"},{"vendor":"red hat","product":"self-service automation portal 2"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44293","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477104","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44293.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34160","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37385","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34374","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57487","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54555","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37628","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37186","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:29795","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26090","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","tags":["web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-66ff-xgx4-vchm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44293.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44293","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487949","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466684","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34160.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6322","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6322","tags":["advisory"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["article"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41240","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41240","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/commit/c361baa18dbdcb3344a41110f4c48ad85bf48f80","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/releases/tag/3.4.0","tags":["article"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-h7mw-gpvr-xq4m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42784","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44293","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44431","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44431","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44432","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44432","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44488","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44495","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44495","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495","tags":["advisory"]},{"url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48526","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48526","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526","tags":["advisory"]},{"url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-182245","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_37385.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2466582","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6321","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6321","tags":["advisory"]},{"url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-44293","title":"protobufjs: Code injection through bytes field defaults in generated toObject code","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:43:33.342Z","modified":"2026-09-09T12:05:01.307Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94","CWE-94"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30031","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:43:33Z","modified":"2026-09-09T12:05:01Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:27.763941Z"}],"ghsa":[{"id":"GHSA-66ff-xgx4-vchm","title":"protobuf.js: Code injection through bytes field defaults in generated toObject code","description":"## Summary\n\nprotobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a schema-controlled `bytes` field default value. A crafted descriptor with a non-string default value for a `bytes` field could cause attacker-controlled code to be emitted into the generated conversion function.\n\n## Impact\n\nAn attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.\n- The descriptor must define a `bytes` field with an attacker-controlled default value.\n- The application must call `toObject` with defaults enabled for the affected type.\n\n## Workarounds\n\nDo not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.","status":"published","published":"2026-05-12T15:06:13Z","modified":"2026-05-12T15:06:15Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:40:07.01746Z"}],"nvd":[{"id":"CVE-2026-44293","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T16:16:56.253Z","modified":"2026-09-09T13:20:07.537Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-44293","title":"protobufjs: Code injection through bytes field defaults in generated toObject code","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.","status":"published","published":"2026-05-13T14:43:33.342Z","modified":"2026-10-28T02:30:21.806303333Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-66ff-xgx4-vchm","title":"protobuf.js: Code injection through bytes field defaults in generated toObject code","description":"## Summary\n\nprotobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a schema-controlled `bytes` field default value. A crafted descriptor with a non-string default value for a `bytes` field could cause attacker-controlled code to be emitted into the generated conversion function.\n\n## Impact\n\nAn attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.\n- The descriptor must define a `bytes` field with an attacker-controlled default value.\n- The application must call `toObject` with defaults enabled for the affected type.\n\n## Workarounds\n\nDo not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.","status":"published","published":"2026-05-12T15:06:13Z","modified":"2026-09-10T03:50:45.707819799Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"RHSA-2026:34160","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","status":"published","published":"2026-07-02T10:17:34Z","modified":"2026-10-20T10:31:02.583742233Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:37385","title":"Red Hat Security Advisory: rh-podman-desktop security advisory update","status":"published","published":"2026-07-10T10:10:49Z","modified":"2026-10-20T10:08:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"ROOT-APP-NPM-CVE-2026-44293","title":"CVE-2026-44293 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-44293 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:04.905319462Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1784250508","title":"TuxCare security update for protobufjs (6 CVEs)","description":"TuxCare rebuilt protobufjs to address 6 CVEs. Fixed in 6.11.6-tuxcare.4.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:36.23843937Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791362263","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 8.0.1-tuxcare.1.","status":"published","published":"2026-10-07T08:37:43Z","modified":"2026-10-15T09:47:58.388325645Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792184156","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.","status":"published","published":"2026-10-16T20:55:56Z","modified":"2026-10-17T01:30:06.508288094Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792755967","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 7.5.4-tuxcare.3.","status":"published","published":"2026-10-23T11:46:07Z","modified":"2026-10-23T13:45:35.143131593Z","updated_at":"2026-11-02T15:43:54.981307Z"}]}}