Npm · Protobufjs-Cli · CVE-2026-54271
**Name of the Vulnerable Software and Affected Versions**
protobufjs-cli versions prior to 1.3.2
protobufjs-cli versions prior to 2.5.0
**Description**
An incomplete fix for unsafe name handling in `pbjs` static and static-module code generation allows the emission of unsafe JavaScript references when generating static output from crafted JSON descriptor input. An attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may cause the generated JavaScript output to contain attacker-controlled code. This injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. Parsing schemas from `.proto` files is not affected.
**Recommendations**
Update to version 1.3.2.
Update to version 2.5.0.
Do not run `pbjs` static or static-module generation on untrusted JSON descriptors.
Validate descriptor-derived names before code generation and reject names that could not have been produced by parsing a valid `.proto` file.
Run code generation in an isolated environment to reduce impact.