CVE-2026-44295
HighSummary
In protobufjs-cli prior to versions 1.2.1 and 2.0.2, there was a vulnerability that allowed the generation of unsafe JavaScript identifiers from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain names could be written into the generated output without sufficient sanitization.
Risk Assessment
Organizations may be exposed to attacks that exploit unsafe identifiers, potentially leading to unauthorized access or execution of malicious code. Exploitation of this vulnerability could compromise the integrity of applications and data.
Recommendation
It is recommended to update protobufjs-cli to versions 1.2.1 or 2.0.2 to mitigate this vulnerability. Additionally, an audit of existing code should be conducted to identify potential threats.
Other vulnerabilities in protobufjs-cli
See all- CVE-2026-42290High
In versions prior to 1.2.1 and 2.0.2, the protobufjs-cli invoked JSDoc by building a shell command string from input file paths. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments.
- CVE-2026-54271High
In protobufjs-cli, prior to versions 1.3.2 and 2.5.0, there was an incomplete fix for unsafe name handling in static code generation. Affected versions could emit unsafe JavaScript references when generating static output from crafted JSON descriptor input.
Original NVD description (English source)
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.