CVE-2026-5758
Description
A flaw was found in the protocol-buffers-schema JavaScript library. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into an object's core definition. This could enable an attacker to change how an application behaves, bypass security measures, or cause the application to stop working (Denial of Service). In specific circumstances, this flaw could potentially lead to an attacker running unauthorized code on the system.
Statement
Red Hat rates this flaw as Moderate. protocol-buffers-schema is a library and does not run on its own, as such, it requires an application to call it and utilize the vulnerable parsing functionality. When the pollution occurs, that application may read whatever malicious property was injected by the attacker, but then has to make a security-relevant decision (ex. granting access, spawning a process, etc.) and do it without checking whether the property actually belongs to the object or was inherited. As such, the impact of this vulnerability is entirely determined by what else is running in the process that calls the library along with what what permissions and checks it has, making the worst-case scenario of RCE only possible if that process is itself vulnerable.
Mitigation
If using protocol-buffers-schema, perform the following checks to help mitigate the impact of this vulnerability:
1. Do not parse `.proto` files from untrusted or semi-trusted sources (ex. user uploads, external repos, third-party APIs, etc.).
2. Audit downstream code for prototype pollution gadgets (ex. template engines, ORM configs, HTTP frameworks).
3. Consider freezing `Object.prototype` in security-sensitive contexts as a defense-in-depth measure (ex. `Object.freeze(Object.prototype);`).
If maintaining a parser or config loader:
1. Never use `reduce` or bracket notation to walk user-controlled paths without filtering dangerous keys.
2. Block `__proto__`, `constructor`, and `prototype` explicitly in any path traversal logic.
3. Add negative test cases to verify that prototype pollution does not occur.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
