Vulnerability · Published May 27, 2022 · Assigned by snyk
CVE-2022-25878Prototype Pollution
High 8.2
In plain English
A high-severity security flaw in protobufjs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)2.3%top 16.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | protobufjs | 6.11.3 | GHSA-g954-5hwp-pp24 |
| npm | protobufjs | 6.10.3 | GHSA-g954-5hwp-pp24 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | protobufjs | unspecified – before 6.11.3 |
References
- https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248 x_refsource_MISC
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507 x_refsource_MISC
- https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197 x_refsource_MISC
- https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f x_refsource_MISC
- https://github.com/protobufjs/protobuf.js/pull/1731 x_refsource_MISC