7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44293

CVE-2026-44293: protobufjs: Code injection through bytes field defaults in generated toObject code

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated JavaScript for toObject conversion could include an unsafe expression derived from a schema-controlled bytes field default value. A crafted descriptor with a non-string default value for a bytes field could cause attacker-controlled code to be emitted into the generated conversion function. This vulnerability is fixed in 7.5.6 and 8.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44293

CVE-2026-44293:

7.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs	npm	<= 7.5.5	7.5.6
protobufjs	npm	>= 8.0.0, <= 8.0.1	8.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2026-44293, is a code injection issue within the protobuf.js library. It specifically affects the toObject conversion process. When a protobuf message is converted to a JavaScript object, the library handles default values for fields. For bytes fields, the default value was insecurely embedded into the generated JavaScript code.

The root cause is in the converter.toObject function located in src/converter.js. The function was using an unsafe method to construct the JavaScript code for default values of bytes fields. It was concatenating the default value as a string directly into the generated code. An attacker could craft a protobuf schema with a malicious string as the default value for a bytes field. When toObject is called with defaults enabled, this malicious string would be executed as code.

The patch addresses this by changing how the default value is written into the generated code. Instead of direct string concatenation, it now uses a method that treats the default value as data (a JSON literal), effectively neutralizing the code injection vector. The analysis of the commit 69b6aed1b46d4f7d069cbea7d3aecbf4831f295d clearly shows this change in src/converter.js within the converter.toObject function.

Vulnerable functions

converter.toObject

src/converter.js

The vulnerability lies in the `converter.toObject` function, which is responsible for converting a message to a plain JavaScript object. When handling a `bytes` field with a default value, the function dynamically generates JavaScript code. The vulnerable version of the code uses string concatenation (`%s`) to insert the default value into the generated code. An attacker could provide a crafted protobuf schema where the default value for a `bytes` field is a malicious string instead of a byte array. This string would then be injected directly into the generated code, leading to code execution. The patch fixes this by using `%j` which treats the value as a JSON literal, effectively sanitizing the input.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.