protobufjs-cli vulnerabilities

In protobufjs-cli prior to versions 1.2.1 and 2.0.2, there was a vulnerability that allowed the generation of unsafe JavaScript identifiers from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain names could be written into the generated output without sufficient sanitization.

In versions prior to 1.2.1 and 2.0.2, the protobufjs-cli invoked JSDoc by building a shell command string from input file paths. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments.

In protobufjs-cli, prior to versions 1.3.2 and 2.5.0, there was an incomplete fix for unsafe name handling in static code generation. Affected versions could emit unsafe JavaScript references when generating static output from crafted JSON descriptor input.