The io.github.ascopes:protobuf-maven-plugin has a vulnerability where the protocDigest parameter is ignored when the protoc executable is specified to be used from the system PATH. This means that if an untrusted protoc binary is present on the PATH, the plugin will not verify its integrity using the provided digest, potentially allowing execution of an unintended or malicious binary. Versions prior to 4.0.2 and before 3.10.2 are affected. A fix is available in versions 4.0.2 and 3.10.2.