Go to packages list

protobufjs-cli

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 3HighAffects 6 versions
  • 0MediumAffects 0 versions
  • 1ModerateAffects 2 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
4vulnerabilities
  • Critical0 (0.0%)
  • High3 (75.0%)
  • Medium0 (0.0%)
  • Moderate1 (25.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 2 vulnerabilities
    • Critical: 0
    • High: 2
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (4)

Known vulnerabilities affecting protobufjs-cli, based on data from OSV.

Vulnerabilities affecting protobufjs-cli
IDSeveritySummaryAffected versionsPublishedSource
GHSA-f38q-mgvj-vph7Moderateprotobufjs : Schema-derived names can shadow runtime-significant properties## Summary protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named `hasOwnProperty`, field or oneof names such as `$type` when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is `rpcCall`. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls i
  • >= 2.0.0, < 2.5.1
  • < 1.3.3
GitHub (opens in a new tab)
GHSA-pr59-h9ph-3fr8Highprotobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names## Summary A previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from `.proto` files is not affected. This is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295. ## Impact An attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may be able to cause generated JavaScript output to contain attacker-controlled c
  • < 1.3.2
  • >= 2.0.0, < 2.5.0
GitHub (opens in a new tab)
GHSA-6r35-46g8-jcw9Highprotobuf.js: Code injection in pbjs static output from crafted schema names## Summary `pbjs` static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. ## Impact An attacker who can provide or influence schemas passed to `pbjs` may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code would run if the generated file is later executed or imported by the application or build
  • < 1.2.1
  • >= 2.0.0, < 2.0.2
GitHub (opens in a new tab)
GHSA-f84p-cvgm-xgjjHighprotobuf.js is Vulnerable to OS Command Injection in the CLI## Summary `pbts` invoked JSDoc by building a shell command string from input file paths and executing it through `child_process.exec`. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. ## Impact An attacker who can control file names or paths passed to `pbts` may be able to execute arbitrary shell commands with the privileges of the process running `pbts`. This affects the protobufjs CLI tooling path. The protobufjs runtime APIs for encoding, decoding, parsing, and loading protobuf messages are not d
  • < 1.2.1
  • >= 2.0.0, < 2.0.2
GitHub (opens in a new tab)
  • GHSA-f38q-mgvj-vph7Moderate
    protobufjs : Schema-derived names can shadow runtime-significant properties
    • >= 2.0.0, < 2.5.1
    • < 1.3.3
    GitHub (opens in a new tab)

    ## Summary protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named `hasOwnProperty`, field or oneof names such as `$type` when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is `rpcCall`. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls i

    CVE: CVE-2026-54269

  • GHSA-pr59-h9ph-3fr8High
    protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
    • < 1.3.2
    • >= 2.0.0, < 2.5.0
    GitHub (opens in a new tab)

    ## Summary A previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from `.proto` files is not affected. This is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295. ## Impact An attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may be able to cause generated JavaScript output to contain attacker-controlled c

    CVE: CVE-2026-54271

  • GHSA-6r35-46g8-jcw9High
    protobuf.js: Code injection in pbjs static output from crafted schema names
    • < 1.2.1
    • >= 2.0.0, < 2.0.2
    GitHub (opens in a new tab)

    ## Summary `pbjs` static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. ## Impact An attacker who can provide or influence schemas passed to `pbjs` may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code would run if the generated file is later executed or imported by the application or build

    CVE: CVE-2026-44295

  • GHSA-f84p-cvgm-xgjjHigh
    protobuf.js is Vulnerable to OS Command Injection in the CLI
    • < 1.2.1
    • >= 2.0.0, < 2.0.2
    GitHub (opens in a new tab)

    ## Summary `pbts` invoked JSDoc by building a shell command string from input file paths and executing it through `child_process.exec`. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. ## Impact An attacker who can control file names or paths passed to `pbts` may be able to execute arbitrary shell commands with the privileges of the process running `pbts`. This affects the protobufjs CLI tooling path. The protobufjs runtime APIs for encoding, decoding, parsing, and loading protobuf messages are not d

    CVE: CVE-2026-42290

Showing 1-4 of 4 vulnerabilities