diff --git a/advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json b/advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json
index 9f9987e94b253..f8a73df0707a5 100644
--- a/advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json
+++ b/advisories/github-reviewed/2026/05/GHSA-66ff-xgx4-vchm/GHSA-66ff-xgx4-vchm.json
@@ -1,17 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-66ff-xgx4-vchm",
-  "modified": "2026-05-12T15:06:13Z",
+  "modified": "2026-05-12T15:06:15Z",
   "published": "2026-05-12T15:06:13Z",
   "aliases": [
     "CVE-2026-44293"
   ],
-  "summary": "protobuf.js: Code injection through bytes field defaults in generated toObject code",
+  "summary": "Improper Control of Generation of Code ('Code Injection') and Improper Verification of Source of a Communication Channel and Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in protobufjs",
   "details": "## Summary\n\nprotobufjs generated JavaScript for `toObject` conversion could include an unsafe expression derived from a schema-controlled `bytes` field default value. A crafted descriptor with a non-string default value for a `bytes` field could cause attacker-controlled code to be emitted into the generated conversion function.\n\n## Impact\n\nAn attacker who can provide or influence a protobuf descriptor may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires the application to load an attacker-controlled schema or descriptor and then convert a message of the affected type with defaults enabled. Applications that only use trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf JSON descriptor or equivalent reflected schema.\n- The descriptor must define a `bytes` field with an attacker-controlled default value.\n- The application must call `toObject` with defaults enabled for the affected type.\n\n## Workarounds\n\nDo not load protobuf schemas or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict field options before loading them and run schema processing in an isolated environment.",
   "severity": [
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:N/SC:H/SI:N/SA:H"
     }
   ],
   "affected": [
@@ -80,9 +80,11 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-94"
+      "CWE-90",
+      "CWE-94",
+      "CWE-940"
     ],
-    "severity": "HIGH",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2026-05-12T15:06:13Z",
     "nvd_published_at": null