CVE-2026-54271: protobufjs-cli Code Injection via JSON Schema Bypass

Technical summary

The vulnerability exists in protobufjs-cli's static and static-module code generation routines when processing JSON descriptor input. Prior attempts to mitigate unsafe name handling were incomplete, leaving a window for attackers to inject JavaScript references that bypass sanitization checks. An attacker controlling or influencing pre-parsed JSON descriptors can craft payloads that result in attacker-controlled code being emitted into the generated output. The attack surface is specifically JSON-based schema input; parsing native .proto files triggers different code paths and is not affected. Successful injection depends on the generated file being executed or imported downstream, combined with invocation of an affected API path that triggers the injected code.

Business impact

Development teams using protobufjs-cli risk shipping applications with embedded malicious code if they accept JSON schema inputs from untrusted sources or allow modification of schemas in their CI/CD pipeline. Compromised generated code can lead to unauthorized data access, system manipulation, or supply chain attacks affecting downstream users of the application. The high CVSS score (8.2) reflects the combination of remote attack surface, code execution capability, and cross-boundary scope impact. Organizations must audit their schema handling practices and regenerate artifacts from trusted sources.

Affected systems

The vulnerability affects protobufjs-cli versions prior to 1.3.2 (in the 1.x branch) and prior to 2.5.0 (in the 2.x branch). The protobufjs project maintains both branches. Any build pipeline or development environment using affected versions to generate JavaScript from JSON schema descriptors is at risk. Teams relying solely on native .proto file parsing are not vulnerable to this specific bypass.

Exploitability

Exploitation requires an attacker to influence JSON descriptor input to the pbjs static code generator—a prerequisite that limits opportunistic exploitation. The attack is network-accessible in scenarios where schema input is received from remote or untrusted sources, but requires user interaction (UI:R) such as a developer explicitly running the generator or CI/CD automation processing attacker-controlled input. The conditional complexity (AC:H) reflects the need for specific generator invocation paths and downstream execution of the generated code. This is not a trivial exploit, but it is practical in supply chain or build pipeline compromise scenarios.

Remediation

Update protobufjs-cli to version 1.3.2 or later if on the 1.x branch, or to version 2.5.0 or later if on the 2.x branch. Verify against the vendor advisory to confirm exact patch versions. Additionally, implement access controls on schema input sources: validate JSON descriptors cryptographically, restrict who can modify or supply schemas in your build pipeline, and avoid accepting untrusted JSON schema input. Regenerate all static artifacts from trusted schema sources after patching.

Patch guidance

Upgrade protobufjs-cli using your package manager (npm, yarn, etc.) to version 1.3.2+ or 2.5.0+. Run `npm update protobufjs-cli` or equivalent for your dependency manager. Verify the installed version matches or exceeds the fixed versions. After updating, rebuild all generated JavaScript code to ensure malicious payloads from prior builds are replaced. Test generated code to confirm backward compatibility and correct functionality.

Detection guidance

Review build logs and artifact repositories for static code generation runs performed with vulnerable versions prior to the known patch date. Inspect generated JavaScript files for unusual variable names, obfuscated patterns, or code that doesn't correspond to your .proto or JSON schemas—particularly looking for eval(), Function(), or dynamic require/import statements injected into output. Monitor CI/CD pipeline for unexpected changes to schema input sources or permissions. Implement code review processes for generated artifacts before deployment.

Why prioritize this

This vulnerability should be prioritized as HIGH because it enables code injection into generated artifacts with direct execution risk. The bypass nature (circumventing a prior CVE fix) suggests incomplete vendor understanding of the attack surface at the time of the first patch, warranting aggressive adoption of the updated fix. While exploitation requires schema input control, teams in open-source projects, API-driven services, or shared development platforms face elevated risk. The cross-boundary scope (affecting downstream users of generated code) amplifies business impact.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: Network accessibility (AV:N) for remote schema delivery, high complexity due to input prerequisites (AC:H), no privilege requirement (PR:N), but user interaction needed for build execution (UI:R). The impact is severe: high confidentiality and integrity loss (C:H, I:H) through code injection, with low availability impact (A:L). The scope is changed (S:C) because injected code affects not just the build environment but downstream consumers of the generated application.

Frequently asked questions