CVE-2023-36665
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
Versions of protobuf.js (protobufjs) from 6.10.0 to 7.x before 7.2.5 are vulnerable to Prototype Pollution. An attacker can exploit a user-controlled protobuf message to modify the Object.prototype, allowing for the addition and overwriting of data and functions.
Risk Assessment
Prototype Pollution can lead to serious security issues within applications, enabling attackers to manipulate data and functions in the application context. This may result in unauthorized access or execution of malicious code.
Recommendation
It is recommended to update protobuf.js to version 7.2.5 or later to mitigate this vulnerability. Additionally, avoid processing untrusted input in functions related to protobuf.
Original NVD description (English source)
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.