CVE-2026-44295: Code Injection in protobuf.js 2.x

The core of the vulnerability lies in the static code generation process within protobuf.js. When generating JavaScript code from a protobuf schema, the library fails to adequately sanitize names used for namespaces, enums, services, and derived types. An attacker can craft a malicious schema containing specially designed names that, when processed by pbjs, result in the generation of JavaScript code containing arbitrary commands. This injected code will execute within the context of the application using protobuf.js, potentially granting the attacker full control over the affected system. The blast radius extends to any application relying on protobuf.js for data serialization and deserialization, particularly those handling untrusted input.

1. Reserviert2026-05-05
2. Veröffentlicht2026-05-13

The primary mitigation is to upgrade to protobuf.js version 2.0.2 or later, which includes the necessary sanitization fixes. If upgrading is not immediately feasible, consider implementing input validation on protobuf schemas before processing them with pbjs. While not a complete solution, this can help prevent the injection of malicious names. Web Application Firewalls (WAFs) configured to inspect generated JavaScript code might be able to detect and block attempts to exploit this vulnerability, but this is highly dependent on the WAF's capabilities and signature coverage. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual JavaScript code generation patterns is recommended.