CVE-2022-25878: Prototype Pollution
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Other sources
The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.
This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-25878?
CVE-2022-25878 is recognized as a high-severity vulnerability due to the risk of prototype pollution.
How do I fix CVE-2022-25878?
To fix CVE-2022-25878, upgrade the protobufjs package to version 6.11.3 or later.
What versions of protobufjs are affected by CVE-2022-25878?
CVE-2022-25878 affects protobufjs versions before 6.11.3, specifically from 6.10.0 to 6.11.2.
What impact does CVE-2022-25878 have on applications?
CVE-2022-25878 allows attackers to manipulate properties of the Object.prototype, which can lead to unexpected behaviors in applications.
Where can I find more details about CVE-2022-25878?
Detailed information about CVE-2022-25878 can be found in the GitHub repository for protobufjs.