protobufjs versions prior to 7.5.6 and 8.0.2 generate JavaScript code for the toObject conversion function that can include unsafe expressions derived from schema-controlled bytes field default values. A crafted protobuf descriptor with a non-string default value for a bytes field can cause attacker-controlled code to be emitted into the generated conversion function, enabling arbitrary code execution in the Node.js process context. This vulnerability (CWE-94) requires low privileges to exploit and does not require user interaction. It is fixed upstream in protobufjs 7.5.6 and 8.0.2. Red Hat advisories confirm the vulnerability affects their products that incorporate protobufjs and process attacker-influenced protobuf schemas at runtime. No practical mitigations other than upgrading are currently available.

An attacker with the ability to supply or influence protobuf descriptors processed by the vulnerable application can achieve arbitrary code execution within the Node.js process context. This can lead to full compromise of the affected application, including confidentiality, integrity, and availability impacts. The vulnerability requires low privileges and no user interaction, making it relatively easy to exploit in environments where protobuf descriptors are attacker-controlled or influenced.

A fix is available by upgrading protobufjs to version 7.5.6 or later, or 8.0.2 or later. Red Hat advisories recommend upgrading affected products that bundle protobufjs to versions including these fixes. No effective mitigations other than upgrading are currently available that meet Red Hat's criteria for ease of use, applicability, and stability.