Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected. This is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295. Impact An attacker who can provide or influence pre-parsed JSON descriptors passed to pbjs static code generation may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked. Preconditions The application or build process must run pbjs static code generation on a pre-parsed JSON descriptor influenced by an attacker. The generated JavaScript file must subsequently be executed or imported. An affected generated API path must be invoked. Workarounds Do not…
Recommended action: Upgrade to 2.5.0 or 1.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. Impact An attacker who can provide or influence protobuf schemas or protobufjs JSON descriptors may be able to make affected message or service types unusable, resulting in denial of service for the affected processing path. Applications using only trusted schemas are affected…
Recommended action: Upgrade to 2.5.1 or 1.3.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. Impact An attacker who can provide or influence schemas passed to pbjs may be able to cause generated JavaScript output to contain attacker-controlled code. The injected code would run if the generated file is later executed or imported by the application or build process. This affects the protobufjs CLI static code generation path. Applications that only use trusted schemas, or that do not execute generated output from untrusted schemas, are not directly affected. Preconditions - The application or build process must run pbjs static code generation on a schema or JSON descriptor influenced by an attacker. - The attacker-controlled input must contain crafted schema…
Recommended action: Upgrade to 2.0.2 or 1.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
pbts invoked JSDoc by building a shell command string from input file paths and executing it through childprocess.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. Impact An attacker who can control file names or paths passed to pbts may be able to execute arbitrary shell commands with the privileges of the process running pbts. This affects the protobufjs CLI tooling path. The protobufjs runtime APIs for encoding, decoding, parsing, and loading protobuf messages are not directly affected by this issue. Preconditions - The application or user must invoke pbts on file paths influenced by an attacker. - The attacker must be able to supply or create a path containing shell-significant characters. - The vulnerable pbts version must execute the generated JSDoc command through a shell. Workarounds Do not run affected versions of pbts on attacker-controlled file names or paths. If this…
Recommended action: Upgrade to 2.0.2 or 1.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.