Listen to this Post
How the CVE Works:
The vulnerability exists in the ProtocResolver.java class. When the plugin is configured to use a protoc executable from the system PATH (<protoc>PATH</protoc>), the code returns early at line 91-93, before it can execute the digest verification logic at line 106. This early return bypasses the `protocDigest` security check entirely. Consequently, the plugin executes the `protoc` binary found in the user’s PATH without validating its integrity against the expected SHA-256 hash. This renders the `protocDigest` feature ineffective, allowing a potentially malicious or untrusted `protoc` binary to be executed if it exists earlier in the PATH than the intended, valid binary.
Platform: Maven Plugin
Version: 3.10.2, 4.0.2
Vulnerability : Feature Bypass
Severity: Low
date: 2025-11-03
Prediction: Patched 2025-11-04
What Undercode Say:
find $PATH -name protoc
// ProtocResolver.java L91-L93
if (source == ProtocSource.PATH) {
return findProtocOnPath(platform);
}
// ... digest check at L106 is skipped for PATH source
How Exploit:
Place malicious protoc binary in a directory that appears earlier in the $PATH environment variable than the directory containing the legitimate protoc binary.
Protection from this CVE
Update to plugin version 3.10.2 or 4.0.2. Alternatively, do not rely on `protocDigest` for security when using <protoc>PATH</protoc>; explicitly specify the path to a trusted protoc binary instead.
Impact:
Execution of untrusted code, potential supply-chain compromise if a malicious protoc is planted on the build system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
