medium6.5
CVE-2026-5758
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass…
Impact
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | protocol-buffers-schema | < 3.6.1 | 3.6.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-j452-xhg8-qg39
- https://nvd.nist.gov/vuln/detail/CVE-2026-5758
- https://github.com/mafintosh/protocol-buffers-schema/pull/70
- https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution
- https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution/