CVE-2026-5758: Mafintosh Protocol-Buffers-Schema Parser

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.

Affected products

• Mafintosh Protocol-Buffers-Schema Parser: from 3.6.0, before 3.6.1 (fixed in 3.6.1)

Published 2026-04-15. Last modified 2026-06-17.