Vulnerabilities in pkg:npm/protobufjs-cli

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pr59-h9ph-3fr8",
  "modified" : "2026-07-15T22:06:57Z",
  "published" : "2026-06-15T20:13:54Z",
  "aliases" : [ "CVE-2026-54271" ],
  "summary" : "protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names",
  "details" : "## Summary\n\nA previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from `.proto` files is not affected.\n\nThis is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295.\n\n## Impact\n\nAn attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may be able to cause generated JavaScript output to contain attacker-controlled code.\n\nThe injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked.\n\n## Preconditions\n\n* The application or build process must run `pbjs` static code generation on a pre-parsed JSON descriptor influenced by an attacker.\n* The generated JavaScript file must subsequently be executed or imported.\n* An affected generated API path must be invoked.\n\n## Workarounds\n\nDo not run affected versions of `pbjs` static or static-module generation on untrusted JSON descriptors. If untrusted JSON descriptors must be accepted, validate descriptor-derived names before code generation and reject names that could not have been produced by parsing a valid `.proto` file. Running code generation in an isolated environment can reduce impact.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "protobufjs-cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.3.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.3.1"
    }
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "protobufjs-cli"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0"
      }, {
        "fixed" : "2.5.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.4.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-pr59-h9ph-3fr8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-54271"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/protobufjs/protobuf.js"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-15T20:13:54Z",
    "nvd_published_at" : "2026-06-22T18:16:45Z"
  }
}