CVE-2026-59876
🔶 mediumSummary
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
CVSS Score
4.8
Medium
EPSS Score
0.2
Exploit Probability
Published Date
2026-07-08
First Seen: 2026-07-09
📊 Relative Risk Intelligence
This CVE is Lower Risk - more severe than 13.5% of all 365,968 vulnerabilities in our database.
#316,658
Below average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: Jul 9, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
NO
Requires human interaction
💥 Technical Impact
Partial
Limited system impact
SSVC data provided by
CISA
Last Modified
2026-07-13
Source
NVD 🔗
CVSS Vector 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE IDs (Weakness Types)