protobufjs@7.2.1 vulnerabilities

protobufjs is a protocol buffer for JavaScript (& TypeScript).

Affected versions of this package are vulnerable to Prototype Pollution. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve:

1. using the function parse to parse protobuf messages on the fly,

2. loading .proto files by using load/loadSync functions, or

3. providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty

Note:

1. This is a different issue from CVE-2022-25878

2. Users who use this package from npm can rest assured that version 7.2.4 includes the fixed code.

Developers using this package from a different CDN should consider 7.2.5 as the fixed version.

Upgrade protobufjs to version 6.11.4, 7.2.4 or higher.