CVE-2026-44295: Code Injection in protobuf.js 2.x

The core of this vulnerability lies in the static code generation process within protobuf.js. When generating JavaScript code from a protobuf schema, the library fails to adequately sanitize names used for namespaces, enums, services, and derived types. An attacker can craft a malicious schema containing specially crafted names that, when processed by pbjs, result in the generation of JavaScript code containing arbitrary commands. This injected code could then be executed within the context of the application using protobuf.js, potentially leading to complete compromise of the system. The blast radius extends to any application relying on this library for data serialization, particularly those handling untrusted input.

1. Reservado2026-05-05
2. Publicada2026-05-13

The primary mitigation is to upgrade to protobuf.js version 2.0.2 or later, which includes the necessary sanitization fixes. If upgrading is not immediately feasible, consider implementing input validation on protobuf schemas before processing them with pbjs. This could involve whitelisting allowed characters or patterns in names. As a temporary workaround, consider using a Web Application Firewall (WAF) to filter requests containing potentially malicious protobuf schemas. While not a complete solution, it can provide an additional layer of defense. After upgrading, confirm the fix by generating code from a known malicious schema and verifying that the generated JavaScript does not contain the injected code.