protobuf.js compiled protobuf definitions into JavaScript functions and, from version 8.2.0 until 8.6.5, parsed string‑keyed map entries in its Text Format extension by using plain property assignment. This allowed a map entry with the key "__proto__" to alter the prototype of the returned map object instead of creating an own map entry. This prototype mutation can lead to prototype pollution, potentially affecting the behavior of objects that share the same prototype.

The affected product is protobufjs:protobuf.js. Versions 8.2.0 through 8.6.5, inclusive, are vulnerable. Affected installations must be updated to version 8.6.5.

The CVSS score of 4.8 indicates low severity, and the EPSS score is <1%; the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers would need to supply crafted Text Format input that the application parses; this could be done locally or via an upstream input chain. Because the vulnerability hinges on the presence of a "__proto__" key in the parsed data, its exploitation is mitigated by restricting or cleansing such inputs. The low CVSS and absence of weaponized exploits suggest a moderate risk, but the potential impact of prototype pollution warrants remediation.