Executive brief
protobufjs-cli is a tool used to generate JavaScript code from Protocol Buffer schemas. A security flaw allows an attacker to inject malicious code into the generated files if they can influence the JSON descriptors used during the build process. If these generated files are later run or imported into an application, the attacker's code could execute, potentially leading to a full system compromise or data theft.
Technical details
This vulnerability is a code injection (CWE-94) resulting from an incomplete fix for CVE-2026-44295. The 'pbjs' command-line tool fails to properly neutralize unsafe names when generating static or static-module output from JSON descriptor inputs. An attacker who can influence these descriptors can inject arbitrary JavaScript references into the output. Exploitation requires the attacker to provide a crafted JSON descriptor to the build process, and for the resulting generated code to be executed or imported by the target application. The vulnerability is fixed in versions 1.3.2 and 2.5.0.
Affected products
- protobufjs protobufjs-cli < 1.3.2, >= 2.0.0 < 2.5.0
Timeline
- 2026-06-12: advisory: GitHub advisory published by dcodeIO
- 2026-06-22: disclosed: NVD publication date