CVE-2026-5758: 
JavaScript vulnerability analysis and mitigation

CVE-2026-5758 is a prototype pollution vulnerability in Mafintosh's protocol-buffers-schema npm package, specifically affecting version 3.6.0. An unauthenticated remote attacker can exploit this flaw to alter application logic, bypass security checks, cause a Denial of Service (DoS), or potentially achieve Remote Code Execution (RCE). The vulnerability was discovered by researcher MorielHarush, disclosed on April 15, 2026, and assigned by CERT/CC. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, NVD).

The root cause is CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), where the parse.js file in protocol-buffers-schema uses reduce to traverse field option paths without sanitizing the path components. When parsing field options such as [(__proto__).polluted = "HACKED"] in a .proto file, the parser accesses Object.prototype directly, injecting properties into every object in the Node.js process. The fix replaces plain object literals {} with Object.create(null) for all data-holding structures, ensuring the __proto__ key is treated as a regular property rather than triggering prototype chain traversal. A detailed write-up and proof-of-concept were published by the discoverer (GitHub PR #70, Researcher Blog).

Successful exploitation allows an attacker to pollute the global Object.prototype in the Node.js process, which can corrupt application logic across all objects in the runtime environment. This can lead to authentication bypass, security check circumvention, Denial of Service, or — in more complex scenarios — Remote Code Execution if the polluted properties influence code paths that execute system commands or evaluate dynamic expressions. Applications that parse untrusted .proto files are most at risk, and the impact extends to any downstream library or application sharing the same Node.js process (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been released beyond the conceptual PoC included in the researcher's pull request description, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.17% (0.00166), indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Identify target: Locate a Node.js application that uses protocol-buffers-schema v3.6.0 (directly or as a transitive dependency, e.g., via pbf → resolve-protobuf-schema) and accepts user-supplied .proto file content for parsing.
2. Craft malicious .proto payload: Construct a .proto file containing a field option that uses __proto__ as a path component, such as:

syntax = "proto3";
message Exploit {
  string a = 1 [(__proto__).polluted = "HACKED"];
}

3. Submit payload: Deliver the malicious .proto content to the target application through any input vector that triggers schema.parse() — e.g., a file upload endpoint, API parameter, or configuration import.
4. Trigger prototype pollution: The parser's reduce traversal accesses Object.prototype via the __proto__ key, injecting the attacker-controlled property into the global prototype chain.
5. Achieve objective: Depending on the application, the polluted property may bypass authentication checks, alter control flow, or — if the application uses the polluted property in a code execution context — achieve RCE (GitHub PR #70, Researcher Blog).

• Logs: Application logs showing unexpected parsing of .proto files containing __proto__ strings in field option paths; Node.js error traces referencing parse.js in protocol-buffers-schema.
• File System: Presence of protocol-buffers-schema v3.6.0 in node_modules (check package-lock.json or yarn.lock for the exact version, including transitive dependencies).
• Process Behavior: Unexpected property values appearing on plain objects {} at runtime (e.g., properties that were never explicitly set); anomalous application behavior such as authentication bypasses or unexpected code execution paths following .proto file parsing.
• Network: Inbound requests delivering .proto file content containing the string __proto__ to parsing endpoints.

Upgrade protocol-buffers-schema to version 3.6.1 or later, which replaces vulnerable plain object literals with Object.create(null) to prevent prototype chain traversal. For applications using this as a transitive dependency (e.g., via maplibre-gl → pbf → resolve-protobuf-schema), add a package manager override (e.g., pnpm.overrides or npm overrides) to force resolution to v3.6.1. As an interim measure, avoid parsing untrusted or user-supplied .proto files until the patch is applied (GitHub Advisory, GitHub PR #70).

The vulnerability was discovered and responsibly disclosed by researcher MorielHarush, who published a detailed blog post and submitted the fix via pull request to the upstream repository. The PR was merged by the maintainer (mafintosh) on April 6, 2026, and the advisory was published on April 15, 2026. A community contributor (RA80533) noted a minor inaccuracy in the PR description — the vulnerable key is __proto__ rather than proto as originally stated. Downstream projects including dimagi/commcare-hq and microsoft-search/pnp-modern-search have already issued dependency bumps to address the vulnerability (GitHub PR #70).