influxdata / influxdata/influxdb
influxdb3-ui (Explorer) 1.8.0 bundles vulnerable protobufjs 7.5.4 — multiple HIGH CVEs, please bump to >=7.5.6/8.0.2
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
Summary
The influxdata/influxdb3-ui:1.8.0 image (InfluxDB 3 Explorer) bundles a vulnerable protobufjs in its backend. A vulnerability scan of the image flags multiple HIGH/MEDIUM CVEs against the copies under /app-root/_backend_app.
Affected dependencies (as shipped in 1.8.0)
protobufjs@7.5.4—/app-root/_backend_app/node_modules/protobufjs/package.json,/app-root/_backend_app/package-lock.json@protobufjs/utf8@1.1.0—/app-root/_backend_app/node_modules/@protobufjs/utf8/package.json
CVEs
| CVE | Severity (CVSS) |
|---|---|
| CVE-2026-44291 | HIGH (8.1) |
| CVE-2026-44293 | HIGH (7.7) |
| CVE-2026-44289 | HIGH (7.5) |
| CVE-2026-44290 | HIGH (7.5) |
| CVE-2026-44288 | MEDIUM (5.3) |
| CVE-2026-44292 | MEDIUM (5.3) |
| CVE-2026-44294 | MEDIUM (5.3) |
These are prototype-pollution / code-generation-gadget issues in protobuf.js.
Fixed versions
protobufjs→ 7.5.6 or 8.0.2@protobufjs/utf8→ 1.1.1
Ask
1.8.0 is currently the newest published tag on Docker Hub (influxdata/influxdb3-ui), so there is no patched image to pull. Could the Explorer backend dependencies be refreshed (bump protobufjs to >=7.5.6/8.0.2 and @protobufjs/utf8 to 1.1.1) and a patch release cut? Happy to validate a candidate image.
Environment
- Image:
influxdata/influxdb3-ui:1.8.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Explorer backend dependency manifests corresponding to /app-root/_backend_app/package-lock.json and the bundled package.json files named in the report. Refresh protobufjs and @protobufjs/utf8 to the specified fixed versions, then build a candidate image and rescan it. Done means the vulnerable dependencies are absent and a patched image can be released.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, javascript
- Domain
- backend, release, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100