{"action":"Upgrade protocol-buffers-schema to 3.6.1 or later.","affected":[{"fixed":"3.6.1","introduced":"0"}],"component":"protocol-buffers-schema","cve_ids":["CVE-2026-5758"],"ecosystem":"npm","epss":0.00534,"exploited":false,"fixed_versions":["3.6.1"],"ghsa_id":"GHSA-j452-xhg8-qg39","id":"tcs_01M5KFWTP6DNHZ49728ZDBY33J","modified_at":"2026-09-10T03:51:02.158228495Z","published_at":"2026-04-15T18:31:58Z","references":["https://osv.dev/vulnerability/GHSA-j452-xhg8-qg39","https://nvd.nist.gov/vuln/detail/CVE-2026-5758","https://github.com/mafintosh/protocol-buffers-schema/pull/70","https://github.com/mafintosh/protocol-buffers-schema","https://morielharush.github.io/2026/04/12/cve-2026-5758-protocol-buffers-schema-prototype-pollution"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-j452-xhg8-qg39","url":"https://osv.dev/vulnerability/GHSA-j452-xhg8-qg39"}],"summary":"Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution"}