CVE-2026-5758 Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution
An attacker can exploit prototype pollution in the protocol-buffers-schema library to execute code, cause denial of service, or bypass security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5758?
CVE-2026-5758 is a medium-severity vulnerability in Mafintosh Protocol-buffers-schema parser, published on 15 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.
Which versions are affected by CVE-2026-5758?
2 open source packages ship an affected version, including protocol-buffers-schema.
| Package | Affected | Fixed in |
|---|---|---|
protocol-buffers-schema npm | All versions | 3.6.1 |
protocol-buffers-schema npm | All versions | 3.6.1 |
How do I fix CVE-2026-5758?
Upgrade protocol-buffers-schema to 3.6.1 or later.
Is CVE-2026-5758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-5758 exists.
Sources
Also known as GHSA-j452-xhg8-qg39, MINI-3782-v826-8fv2, MINI-652x-h5j6-qqxh, MINI-6wwc-9mgc-pj3c, MINI-f9wq-73xm-76g6.