GHSA-6r35-46g8-jcw9
High · 8.7CVSS
8.7
EPSS
—
Published
May 12, 2026
CISA due date
—
The record
protobuf.js: Code injection in pbjs static output from crafted schema names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | protobufjs-cli | 0 | 1.2.1 |
| npm | protobufjs-cli | 2.0.0 | 2.0.2 |
Related vulnerabilities
- CVE-2026-44295 protobufjs-cli is the command line add-on for protobuf.js. Same vulnerability
- CVE-2026-54271 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs-cli
- GHSA-pr59-h9ph-3fr8 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names Also affects protobufjs-cli
- GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties Also affects protobufjs-cli
- CVE-2026-42290 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- GHSA-f84p-cvgm-xgjj protobuf.js is Vulnerable to OS Command Injection in the CLI Also affects protobufjs-cli
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94