CVEFinder.io

CVE-2022-25878

⚠️ high
🔍 Scan for this CVE
Summary

The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files

CVSS Score
8.2
High
EPSS Score
0.4
Exploit Probability
Published Date
2022-05-27
First Seen: 2026-01-05
📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 79.7% of all 321,566 vulnerabilities in our database.

#65,290
Top 25% most severe
Severity Percentile
Last Modified 2024-11-21
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CWE IDs (Weakness Types)
CWE-1321

📦 Affected Products 1

Vendor Product Status Affected Versions
protobufjs_project protobufjs Affected
< 6.11.3

🔗 References 5

https://github.com/protobufjs/protobuf.js/blob/d13d5...
Broken Link
https://github.com/protobufjs/protobuf.js/commit/b5f...
Patch Third Party Advisory
https://github.com/protobufjs/protobuf.js/pull/1731
Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507
Exploit Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248
Exploit Patch Third Party Advisory

🔗 Related CVEs 5

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-44290 ⚠️ high 7.5 0.1 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed ce... 2026-05-13
CVE-2026-44291 ⚠️ high 8.1 0.1 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs used plain... 2026-05-13
CVE-2026-44288 🔶 medium 5.3 0.0 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs includes a... 2026-05-13
CVE-2023-36665 ⛔ critical 9.8 1.7 "protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than... 2023-07-05
CVE-2018-3738 🔶 medium 5.5 0.2 protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. 2018-06-07
These CVEs affect the same products