The protocol-buffers-schema library v3.6.0 is vulnerable to JavaScript prototype pollution. Exploitation allows an attacker to modify properties on Object.prototype, which can change application logic, bypass security checks, trigger denial‑of‑service conditions, or even lead to remote code execution depending on the target environment and how the parsed data is subsequently used.

The affected product is Mafintosh’s protocol‑buffers‑schema parser, specifically version 3.6.0. Any application that depends on or loads this version is at risk.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting the current exploitation probability is unknown. The likely attack vector is remote, via an attacker supplying a crafted protocol buffer message to the vulnerable parser. Because prototype pollution can alter fundamental object behavior, the full impact can be significant if the application uses the corrupted objects for privileged operations. Additionally, the CVSS score is 6.5, indicating moderate severity.