{"action":"Upgrade protobufjs to 6.10.3 or later.","affected":[{"fixed":"6.11.3","introduced":"6.11.0"},{"fixed":"6.10.3","introduced":"6.10.0"}],"component":"protobufjs","cve_ids":["CVE-2022-25878"],"ecosystem":"npm","epss":0.02329,"exploited":false,"fixed_versions":["6.11.3","6.10.3"],"ghsa_id":"GHSA-g954-5hwp-pp24","id":"tcs_01M5KFR49J309MNQNA7C54CN9V","modified_at":"2025-01-14T10:57:13.409784Z","published_at":"2022-05-28T00:00:20Z","references":["https://osv.dev/vulnerability/GHSA-g954-5hwp-pp24","https://nvd.nist.gov/vuln/detail/CVE-2022-25878","https://github.com/protobufjs/protobuf.js/pull/1731","https://github.com/protobufjs/protobuf.js/pull/1735","https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f","https://github.com/protobufjs/protobuf.js","https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507","https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g954-5hwp-pp24","url":"https://osv.dev/vulnerability/GHSA-g954-5hwp-pp24"}],"summary":"Prototype Pollution in protobufjs"}