Proto6 flaws in protobuf.js enable RCE
Six vulnerabilities in protobuf.js allow remote code execution and DoS through malicious schemas, affecting Node.js apps, Google Cloud libraries, and CI/CD pipelines.
Sourcethehackernews.com — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Cybersecurity researchers at Cyera have disclosed six vulnerabilities collectively dubbed Proto6 in protobuf.js, a widely-used JavaScript and TypeScript implementation of Google's Protocol Buffers serialization mechanism. The flaws affect Node.js applications using protobuf.js, Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines. The vulnerabilities stem from the library treating schemas and metadata as trusted by default, creating validation gaps that allow attackers to influence application behavior through malicious protobuf schemas, descriptors, or payloads.
The most critical flaw is CVE-2026-44291, which enables arbitrary JavaScript execution when attacker-controlled input reaches a prototype pollution gadget and protobuf.js later encodes or decodes a message in the same process. The library resolves type names through plain property lookups, allowing a polluted Object.prototype to inject attacker-controlled strings into generated encoder/decoder functions compiled via Function(). Other vulnerabilities enable DoS attacks through unbounded recursion, process-wide crashes from unsafe option paths, and code injection in static output generation. Attack scenarios include poisoning CI/CD workflows to leak build secrets and crashing WhatsApp bots built with Baileys through specially crafted messages.
Cyera warns that these conditions are increasingly common in data and AI ecosystems that routinely exchange schemas and configuration files across services and platforms. The vulnerabilities affect protobuf.js versions 7.5.5 and earlier, plus 8.0.0 through 8.0.1, as well as protobufjs-cli versions 1.2.0 and earlier, plus 2.0.0 through 2.0.1. Patches are available in protobuf.js 7.5.6 and 8.0.2, and protobufjs-cli 1.2.1 and 2.0.2. Organizations using the library in databases, vector stores, inference pipelines, orchestration systems, and cloud SDKs should prioritize updates to mitigate risks to enterprise and AI workloads.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by Node.js Process (Possible protobuf.js RCE)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js process spawning a command interpreter or scripting engine, consistent with post-exploitation of a JavaScript prototype-pollution RCE such as Proto6/CVE-2026-44291 in protobuf.js. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by Node.js Process
id: 2da4ff17-06fe-5248-910e-00ee18669d86
status: experimental
description: Detects command interpreters or scripting engines spawned as children
of node.exe/node, which can indicate exploitation of a prototype-pollution RCE (e.g.
Proto6/CVE-2026-44291) in a protobuf.js-based Node.js application leading to arbitrary
code execution.
references:
- https://cyera.com
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \node.exe
child_selection:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \bash.exe
- \wscript.exe
- \cscript.exe
- \curl.exe
- \certutil.exe
filter_devtools:
CommandLine|contains:
- 'npm '
- 'npx '
- node_modules\.bin
- --version
condition: selection and child_selection and not filter_devtools
fields:
- ParentImage
- Image
- CommandLine
- ParentCommandLine
falsepositives:
- Legitimate build/deploy scripts that invoke shells from a Node.js orchestrator (e.g.
gulp, npm scripts)
- Developer tooling that launches editors or linters from a running Node.js process
level: medium
tags:
- attack.t1059.007
- attack.t1190
author: Vorant
Node.js Process Modifying CI/CD or Generated Schema Output Files
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Node.js process writing to CI/CD configuration or generated code/schema files shortly after processing external protobuf schemas, consistent with stored data manipulation via protobuf.js static output code-injection flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Node.js Process Writing to CI-CD or Generated Code Files
id: c22d989b-3d37-5c2a-b9b4-6473fbe3edd5
status: experimental
description: Detects file writes by a node.exe/node process to CI/CD pipeline configuration
files or generated JavaScript/TypeScript output, which may indicate poisoning of
build artifacts or secrets via protobuf.js static code generation vulnerabilities
(Proto6).
references:
- https://cyera.com
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \node.exe
target_selection:
TargetFilename|contains:
- .github\workflows
- .gitlab-ci
- Jenkinsfile
- .pb.js
- .pb.d.ts
- proto.js
condition: selection and target_selection
fields:
- Image
- TargetFilename
- User
falsepositives:
- Normal build pipeline steps that regenerate protobuf bindings or update CI configuration
as part of legitimate development
- Developer running protoc/pbjs code generation locally
level: medium
tags:
- attack.t1565.001
- attack.t1195.001
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/six-proto6-vulnerabilities-in.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs