CyberRota Analysis
AI-GeneratedThe vulnerability affects the protobufjs library in Java, specifically versions 8.2.0 to 8.6.5, where improper handling of string-keyed map entries can allow an attacker to manipulate the prototype of the returned map object by using the key "__proto__". This could lead to unexpected behavior or security issues in applications relying on this library. Developers and organizations utilizing protobufjs in their Java applications should prioritize upgrading to version 8.6.5 or later to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)