CVE-2026-44295: high-severity vulnerability in protobufjs protobuf.js
protobufjs-cli: Code injection in pbjs static output from crafted schema names
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected products
protobufjs · protobuf.jsRelated CVEs — protobufjs protobuf.js
In the same product, most dangerous first.
CVE-2026-41242CRITICALprotobufjs has an arbitrary code execution issueEPSS 0.8%CVE-2026-44289HIGHprotobufjs: Denial of service through unbounded protobuf recursionEPSS 0.6%CVE-2026-44291HIGHprotobufjs: Code generation gadget after prototype pollutionEPSS 0.5%CVE-2026-48712HIGHprotobufjs: Denial of service through unbounded Any expansion during JSON conversionEPSS 0.5%CVE-2026-44294MEDIUMprotobufjs: Denial of service from crafted field names in generated codeEPSS 0.4%CVE-2026-44293HIGHprotobufjs: Code injection through bytes field defaults in generated toObject codeEPSS 0.4%