← Vulnerability feed

Vulnerability record · CVE-2023-36665 · published 5 July 2023

CVE-2023-36665: Protobufjs project protobufjs prototype pollution vulnerability

PProtobufjs Project · Protobufjs

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.

9.8 CVSS 3.1 Critical EPSS 1.7% · top 24.0% CWE-1321 · Prototype pollution
9.8CVSS 3.1 base score
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d Patch
https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4 Patch
https://github.com/protobufjs/protobuf.js/pull/1899 PatchVendor Advisory
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4 Release Notes
https://security.netapp.com/advisory/ntap-20240628-0006/
https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665 ExploitPatchThird Party Advisory
https://github.com/protobufjs/protobuf.js/commit/e66379f451b0393c27d87b37fa7d271619e16b0d Patch
https://github.com/protobufjs/protobuf.js/compare/protobufjs-v7.2.3...protobufjs-v7.2.4 Patch
https://github.com/protobufjs/protobuf.js/pull/1899 PatchVendor Advisory
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.2.4 Release Notes
https://security.netapp.com/advisory/ntap-20240628-0006/
https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665 ExploitPatchThird Party Advisory

Track CVE-2023-36665 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.4CVE-2026-41242Protobufjs project protobufjs code injection vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in…EPSS 0.99%8.1CVE-2026-44291Protobufjs project protobufjs code injection vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain objects with inherited proto…EPSS 0.42%7.7CVE-2026-44293Protobufjs project protobufjs code injection vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conve…EPSS 0.73%7.5CVE-2026-59877Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing throug…EPSS 0.67%7.5CVE-2026-48712Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit whi…EPSS 0.46%7.5CVE-2026-45740Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs could recurse without a depth limit whi…EPSS 0.46%7.5CVE-2026-44289Protobufjs project protobufjs vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs could recurse without a depth limit whi…EPSS 0.68%7.5CVE-2026-44290Protobufjs project protobufjs prototype pollution vulnerabilityprotobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to …EPSS 0.50%

Source: NIST National Vulnerability Database (record CVE-2023-36665), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.