Threats tagged 'ghsa-xq3m-2v4x-88gg'

protobufjs versions prior to 7.5.5 and between 8.0.0 and before 8.0.1 contain a critical vulnerability allowing arbitrary JavaScript code execution when loading crafted protobuf schema metadata. This occurs due to insufficient validation of schema-controlled type names and references during runtime code generation. Exploitation requires attacker control over the protobuf schema or JSON descriptor loaded by the application. Applications that only use trusted, application-defined schemas are not directly affected. A fix is available in versions 7.5.5 and 8.0.1.