TI-2026-39171 Aliases CVE-2026-54271 GHSA-pr59-h9ph-3fr8

protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

LOW 37CWE-94Published 2026-06-22 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected. This is a bypass of CVE-2026-44295. An attacker who can provide or influence pre-parsed JSON descriptors passed to pbjs static code generation may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. This vulnerability is fixed in 1.3.2 and 2.5.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00303 23rd percentileScored 2026-11-07

Fix Fixed protobufjs-cli (protobufjs): 1.3.2, 2.4.2protobufjs-cli (npm): 1.3.2, 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
protobufjs	protobufjs-cli	before 1.3.2; 2.0.0 to before 2.4.2	1.3.2, 2.4.2	Patch available	CNA
—	protobufjs-cli (npm)	before 1.3.2	1.3.2	Patch available	GHSA-pr59-h9ph-3fr8
—	protobufjs-cli (npm)	2.0.0 to before 2.5.0	2.5.0	Patch available	GHSA-pr59-h9ph-3fr8

protobufjs-cli Vendorprotobufjs Affected before 1.3.2; 2.0.0 to before 2.4.2 Fixed in 1.3.2, 2.4.2 Patch available CNA
protobufjs-cli (npm) Vendor— Affected before 1.3.2 Fixed in 1.3.2 Patch available GHSA-pr59-h9ph-3fr8
protobufjs-cli (npm) Vendor— Affected 2.0.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-pr59-h9ph-3fr8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:protobufjs_project:protobufjs-cli::::::node.js::*	before 1.3.2; 2.0.0 to before 2.5.0	Vulnerable	protobufjs

cpe:2.3:a:protobufjs_project:protobufjs-cli:*:*:*:*:*:node.js:*:* Versions before 1.3.2; 2.0.0 to before 2.5.0 Vulnerable ·protobufjs

Remediation

Fix · CNA protobufjs-cli (protobufjs) Fixed in 1.3.2, 2.4.2
Fix · GHSA-pr59-h9ph-3fr8 protobufjs-cli (npm) Fixed in 1.3.2 Advisory →
Fix · GHSA-pr59-h9ph-3fr8 protobufjs-cli (npm) Fixed in 2.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54271
2026-10-03 Alias added: GHSA-pr59-h9ph-3fr8

References

Advisory 2

Other 1

https://github.com/protobufjs/protobuf.js

TI-2026-32266 protobufjs-cli: Code injection in pbjs static output from crafted schema names CVSS 3.1HIGH 8.7
TI-2026-30601 protobufjs-cli: OS Command Injection CVSS 3.1HIGH 7.8
TI-2026-39169 protobufjs: Schema-derived names can shadow runtime-significant properties CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences