CVE-2026-5758: Prototype Pollution in protocol-buffers-schema npm Package

Vulnerability Summary: Prototype Pollution via .proto Vulnerability Overview Vulnerability Name: Prototype Pollution via .proto: When Your Schema Poisons the Runtime CVE ID: CVE-2026-5758 CWE ID: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) Affected Software: (npm package) Affected Versions: < 3.6.1 Vulnerability Principle: The parser uses to traverse paths when processing field options (e.g., ). If an attacker supplies as a path component, the parser will resolve it to , thereby injecting properties into all objects. Impact Scope Severity Level: CRITICAL Potential Consequences: Authentication Bypass: If authorization logic checks and the polluted prototype provides a default value, access control will fail. Denial of Service (DoS): Polluting keys such as , , , etc., may cause process crashes or infinite loops. Remote Code Execution (RCE): In scenarios involving template engines, subprocess generation, etc., RCE may be possible. Logic Corruption: Any code that reads object properties without using checks may be affected. Attack Surface: Since files are often treated as trusted configuration, parsing files from external sources (user uploads, third-party APIs) can easily trigger the issue. Remediation Upgrade Version: Update to 3.6.1 or later. Developer Recommendations: Check whether you are parsing files from untrusted sources (user uploads, external repositories, third-party APIs). Audit downstream code for prototype pollution gadgets (e.g., template engines, ORM configurations). Consider freezing in security-sensitive contexts. * When maintaining parsers, never use or bracket notation to traverse user-controlled paths without filtering dangerous keys (such as , , ). Proof-of-Concept Code (POC)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-5758: Prototype Pollution in protocol-buffers-schema npm Package