GHSA-pr59-h9ph-3fr8
High · 8.2CVSS
8.2
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | protobufjs-cli | 0 | 1.3.2 |
| npm | protobufjs-cli | 2.0.0 | 2.5.0 |
Related vulnerabilities
- CVE-2026-54271 protobufjs-cli is the command line add-on for protobuf.js. Same vulnerability
- CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs-cli
- GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties Also affects protobufjs-cli
- CVE-2026-44295 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- CVE-2026-42290 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- GHSA-6r35-46g8-jcw9 protobuf.js: Code injection in pbjs static output from crafted schema names Also affects protobufjs-cli
- GHSA-f84p-cvgm-xgjj protobuf.js is Vulnerable to OS Command Injection in the CLI Also affects protobufjs-cli
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94