CVE-2026-54271

Name of the Vulnerable Software and Affected Versions protobufjs-cli versions prior to 1.3.2 protobufjs-cli versions prior to 2.5.0

Description An incomplete fix for unsafe name handling in pbjs static and static-module code generation allows the emission of unsafe JavaScript references when generating static output from crafted JSON descriptor input. An attacker who can provide or influence pre-parsed JSON descriptors passed to pbjs static code generation may cause the generated JavaScript output to contain attacker-controlled code. This injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. Parsing schemas from .proto files is not affected.

Recommendations Update to version 1.3.2. Update to version 2.5.0. Do not run pbjs static or static-module generation on untrusted JSON descriptors. Validate descriptor-derived names before code generation and reject names that could not have been produced by parsing a valid .proto file. Run code generation in an isolated environment to reduce impact.