Prototype Pollution Vulnerability in Protobuf.js by ProtobufJS

CVE-2023-36665

What is CVE-2023-36665?

Protobuf.js versions 6.10.0 to 7.x prior to 7.2.5 are susceptible to a Prototype Pollution vulnerability. This flaw enables attackers to manipulate the prototype of Object.prototype by injecting user-controlled protobuf messages. Techniques for exploitation include employing the parse function to dynamically handle protobuf messages, using the load/loadSync functions to load .proto files, or providing untrusted input to ReflectionObject.setParsedOption and util.setProperty functions. Such manipulations can lead to significant security risks if left unaddressed.

References