CVE-2026-44293: protobuf.js: Code injection through bytes field defaults in generated toObject code

May 12, 2026

protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function.

References

github.com/advisories/GHSA-66ff-xgx4-vchm
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2
github.com/protobufjs/protobuf.js/security/advisories/GHSA-66ff-xgx4-vchm
nvd.nist.gov/vuln/detail/CVE-2026-44293

Code Behaviors & Features

Detect and mitigate CVE-2026-44293 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →