CVE-2022-25878

protobufjs: Prototype Pollution via util.setProperty or ReflectionObject.setParsedOption methods

Loading…

Severity

Moderate

Red Hat Product Security

8.2

CVSS 3.1

Review impact separately from score.

Published · May 27, 2022

Updated · November 22, 2025

Description

A flaw was found in protobufjs, where it is vulnerable to Prototype Pollution, allowing an attacker to add/modify properties of the Object.prototype. This vulnerability can occur by providing untrusted user input to the util.setProperty or to the ReflectionObject.setParsedOption functions, and also by parsing/loading .proto files.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')