GHSA-j2pc-v64r-mv4f Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
The Protobuf Maven Plugin ignores protocDigest when using protoc from PATH, allowing execution of untrusted binaries despite integrity checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-j2pc-v64r-mv4f?
GHSA-j2pc-v64r-mv4f is a vulnerability in io.github.ascopes:protobuf-maven-plugin, published on 4 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Summary
The expected protocDigest is ignored when protoc is taken from the PATH.
Details
The documentation for the protocDigest parameter says:
> … Users may wish to specify this if using a PATH-based binary …
However, when specifying <protoc>PATH</protoc> the protocDigest is not actually checked because the code returns here already
https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L91-L93
before the digest check: https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L106
PoC
Specify:
<protoc>PATH</protoc>
<protocDigest>sha256:0000000000000000000000000000000000000000000000000000000000000000</protocDigest>
And notice how the protoc on the PATH is not rejected, despite a digest mismatch.
Impact
Users who have an untrusted protoc executable on their PATH and rely <protocDigest> as protection are affected.
Which versions are affected by GHSA-j2pc-v64r-mv4f?
4 open source packages ship an affected version, including io.github.ascopes:protobuf-maven-plugin.
| Package | Affected | Fixed in |
|---|---|---|
io.github.ascopes:protobuf-maven-plugin Maven | All versions | 3.10.2 |
io.github.ascopes:protobuf-maven-plugin Maven | All versions | 3.10.2 |
io.github.ascopes:protobuf-maven-plugin Maven | From 4.0.0 | 4.0.2 |
io.github.ascopes:protobuf-maven-plugin Maven | From 4.0.0 | 4.0.2 |
How do I fix GHSA-j2pc-v64r-mv4f?
Upgrade io.github.ascopes:protobuf-maven-plugin to a fixed version for your release line: 3.10.2 or 4.0.2.
Is GHSA-j2pc-v64r-mv4f being exploited?
There is no known exploitation of GHSA-j2pc-v64r-mv4f in the wild and no public exploit code.