org.webjars.npm:protobufjs@6.10.1

Affected versions of this package are vulnerable to Uncontrolled Recursion through the Root.fromJSON or Namespace.addJSON functions. An attacker can cause resource exhaustion and disrupt service availability by submitting a crafted JSON descriptor with deeply nested namespace definitions.

Note:

This is only exploitable if all of the following conditions are met:

• The application must load JSON descriptor data influenced by an attacker.

• The crafted descriptor must contain deeply nested nested namespace objects.

• The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Arbitrary Code Injection in the toObject function when handling a schema-controlled bytes field default value. An attacker can execute arbitrary JavaScript code by providing a crafted descriptor with a malicious default value for a bytes field, which is then used in the generated conversion function.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Prototype Pollution via schema option path handling. An attacker can perform prototype pollution by supplying a crafted protobuf schema or JSON descriptor whose option paths traverse inherited properties, allowing writes to global JavaScript constructors and corrupting process-wide state, leading to persistent denial of service.

Note: This is only exploitable if the application allows an attacker to control or influence a protobuf schema or JSON descriptor and parses or loads that schema through reflection APIs such as parse, Root.load, Root.loadSync, or Root.fromJSON, with crafted input containing option paths that reach unsafe inherited properties during option processing.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Prototype Pollution in the process of copying enumerable properties from a user-supplied object to a generated message instance without filtering the __proto__ property. An attacker can alter the prototype of individual message instances by supplying an object containing an own enumerable __proto__ property.

Note: This is only exploitable if the application allows plain objects to be passed to message constructors or creation helpers that copy arbitrary enumerable properties.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Prototype Pollution in the code generation. An attacker who has achieved prototype pollution by a different exploit can execute arbitrary JavaScript code by polluting Object.prototype prior to invoking the affected process.

Note: This is only exploitable if the application uses protobufjs functionality that generates encode or decode code for affected types.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions when handling field names containing control characters in schemas or JSON descriptors. An attacker can cause runtime errors and disrupt application functionality by supplying crafted schemas or descriptors that trigger syntax errors during code generation.

Note: This is only exploitable if the application loads untrusted schemas or descriptors and performs operations that trigger code generation, such as encode, decode, verify, fromObject, or toObject.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Uncontrolled Recursion through unbounded recursion when decoding nested message fields. An attacker can exhaust the call stack and cause the application to crash by supplying specially crafted protobuf binary data containing deeply nested structures.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the decoding of overlong UTF-8 strings. An attacker can bypass application-level byte filtering or validation by sending malicious sequences that decode to canonical characters. This is only exploitable if the application decodes protobuf binary data using the minimal UTF-8 decoder and relies on byte-level filtering before string decoding.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Arbitrary Code Injection through the handling of user-supplied protobuf definitions, specifically via the Type's name field. An attacker can execute arbitrary JavaScript code by injecting malicious payloads into the protobuf definition, which are then executed during object decoding.

Notes:

• The vulnerability was introduced during the migration to codegen 2 where sanitization of the type name was modified.
• Additional security measures were introduced in @protobufjs/codegen@2.0.5, which could hinder exploitation on vulnerable versions.

A fix was pushed into the master branch but not yet published.

Affected versions of this package are vulnerable to Prototype Pollution. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve:

1. using the function parse to parse protobuf messages on the fly,

2. loading .proto files by using load/loadSync functions, or

3. providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty

Note:

1. This is a different issue from CVE-2022-25878

2. Users who use this package from npm can rest assured that version 7.2.4 includes the fixed code.

Developers using this package from a different CDN should consider 7.2.5 as the fixed version.

Upgrade org.webjars.npm:protobufjs to version 6.11.4, 7.2.4 or higher.