Critical severity9.8NVD Advisory· Published Jul 5, 2023· Updated Jun 17, 2026
CVE-2023-36665
CVE-2023-36665
Description
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
protobufjsnpm | >= 7.0.0, < 7.2.5 | 7.2.5 |
protobufjsnpm | >= 6.10.0, < 6.11.4 | 6.11.4 |
Affected products
6- protobuf.js/protobuf.jsdescription
- ghsa-coords4 versionspkg:npm/protobufjspkg:apk/chainguard/kibana-8pkg:apk/chainguard/kibana-8-bitnamipkg:apk/chainguard/kibana-8-iamguarded
>= 7.0.0, < 7.2.5+ 3 more
- (no CPE)range: >= 7.0.0, < 7.2.5
- (no CPE)range: < 8.17.3-r2
- (no CPE)range: < 8.17.3-r2
- (no CPE)range: < 8.17.3-r2
- cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*Range: >=6.10.0,<7.2.5
Patches
Vulnerability mechanics
References
11- github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0dnvdPatchWEB
- github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4nvdPatchWEB
- github.com/protobufjs/protobuf.js/pull/1899nvdPatchVendor AdvisoryWEB
- www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665nvdExploitPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-h755-8qp9-cq85ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-36665ghsaADVISORY
- github.com/protobufjs/protobuf.js/commits/release-6.11.4ghsaWEB
- github.com/protobufjs/protobuf.js/issues/1918ghsaWEB
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4nvdRelease NotesWEB
- security.netapp.com/advisory/ntap-20240628-0006ghsaWEB
- security.netapp.com/advisory/ntap-20240628-0006/nvd
News mentions
0No linked articles in our index yet.