Homepage

org.webjars.npm:protobufjs@6.10.1

  • latest version

    8.0.0

  • latest non vulnerable version

    5.0.3

  • first published

    10 years ago

  • latest version published

    3 months ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:protobufjs package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Arbitrary Code Injection

    Affected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's name field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.

    Notes:

    • The vulnerability was introduced during the migration to codegen 2 where sanitization of the type name was modified.
    • Additional security measures were introduced in @protobufjs/codegen@2.0.5, which could hinder exploitation on vulnerable versions.

    How to fix Arbitrary Code Injection?

    A fix was pushed into the master branch but not yet published.

    [6.8.6,)
    • H
    Prototype Pollution

    Affected versions of this package are vulnerable to Prototype Pollution. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve:

    1. using the function parse to parse protobuf messages on the fly,

    2. loading .proto files by using load/loadSync functions, or

    3. providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty

    Note:

    1. This is a different issue from CVE-2022-25878

    2. Users who use this package from npm can rest assured that version 7.2.4 includes the fixed code.

    Developers using this package from a different CDN should consider 7.2.5 as the fixed version.

    How to fix Prototype Pollution?

    Upgrade org.webjars.npm:protobufjs to version 6.11.4, 7.2.4 or higher.

    [6.10.0,6.11.4)[7.2.0,7.2.4)
    • H
    Prototype Pollution

    Affected versions of this package are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype.

    This vulnerability can occur in multiple ways:

    1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
    2. by parsing/loading .proto files

    How to fix Prototype Pollution?

    Upgrade org.webjars.npm:protobufjs to version 6.10.3, 6.11.3 or higher.

    [6.10.0,6.10.3)[6.11.0,6.11.3)
    Go back to all versions of this package