-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from four primary vectors: 1) util.setProperty lacked prototype protection checks (fixed in e66379f), 2) setParsedOption accepts untrusted paths, 3) parse() handles raw protobuf messages with embedded options, and 4) load/loadSync process schema definitions. All were explicitly listed in vulnerability descriptions and patched versions add prototype access checks. The commit diff shows prototype protection added to util.setProperty, and advisory examples demonstrate exploitation through these entry points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| protobufjs | npm | >= 6.10.0, < 6.11.4 | 6.11.4 |
| protobufjs | npm | >= 7.0.0, < 7.2.5 | 7.2.5 |
A Semantic Attack on Google Gemini - Read the Latest Research