CVE-2026-54271 Details
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected. This is a bypass of CVE-2026-44295. An attacker who can provide or influence pre-parsed JSON descriptors passed to pbjs static code generation may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. This vulnerability is fixed in 1.3.2 and 2.5.0.
A code injection vulnerability has been identified in protobufjs-cli, the command line tool for protobuf.js, affecting versions prior to 1.3.2 and 2.5.0. The issue arises in the 'pbjs' static and static-module code generation, where crafted JSON descriptor input can lead to the generation of unsafe JavaScript references. This vulnerability bypasses a previous fix related to name handling and could allow an attacker to inject code that executes when the generated file is imported or executed, provided an affected API path is invoked. The vulnerability does not affect the standard parsing of schemas from .proto files.
Users can upgrade to protobufjs-cli versions 1.3.2 or 2.5.0 to address this vulnerability. If untrusted JSON descriptors must be used, they should be validated before code generation to ensure they do not contain names that could be exploited.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-pr59-h9ph-3fr8 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs-cli | < 1.3.2 >= 2.0.0, < 2.5.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |