Critical RCE in protobuf.js Demands Immediate Patching

Cyber Updates - Asher Tamam reports a critical Remote Code Execution (RCE) vulnerability in protobuf.js, stemming from insecure dynamic function creation within schemas. This flaw, affecting versions ≤ 8.0.0 and ≤ 7.5.4, could allow attackers to execute arbitrary JavaScript code within processes utilizing the library.

The vulnerability essentially turns schema definitions into attack vectors, enabling malicious code injection. This isn’t just a theoretical risk; it’s a direct path for attackers to compromise systems where protobuf.js is used to parse untrusted data. The implications for supply chain security are clear: if your application or a dependency uses a vulnerable version, you’re exposed.

The good news is a fix is available. Cyber Updates - Asher Tamam notes the vulnerability has been patched in versions 8.0.1 and 7.5.5. Defenders need to prioritize this update immediately to close a significant RCE avenue.