CVE-2026-44291

[CVE catalog]

Severity

High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

May 13, 2026, 2:42:13 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.50% · Oct 25, 2026

A flaw was found in protobufjs, a library that compiles protobuf definitions into JavaScript functions. This prototype pollution vulnerability occurs when `Object.prototype` is polluted, allowing attacker-controlled properties to be resolved as valid protobuf type information. This can lead to attacker-controlled strings being emitted into generated JavaScript code, potentially resulting in arbitrary code execution. protobufjs: protobufjs: Arbitrary Code Execution via prototype pollution This Important flaw in protobufjs, a JavaScript library, potentially enables arbitrary code execution when a separate prototype pollution vulnerability is present in an application. Exploitation requires an attacker to first pollute `Object.prototype` and then trigger protobufjs functionality that generates encode or decode code for affected types. Red Hat products utilizing `protobufjs` may be impacted if they are vulnerable to prototype pollution. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.