CVE-2026-44295 protobufjs-cli: Code injection in pbjs static output from crafted schema names
Attackers can execute arbitrary code by providing crafted schema names to the protobufjs CLI static code generator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44295?
CVE-2026-44295 is a high-severity code injection vulnerability in protobufjs protobuf.js, published on 13 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.
Weakness: CWE-94
Which versions are affected by CVE-2026-44295?
4 open source packages ship an affected version, including protobufjs-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
protobufjs-cli npm | All versions | 1.2.1 |
protobufjs-cli npm | All versions | 1.2.1 |
protobufjs-cli npm | From 2.0.0 | 2.0.2 |
protobufjs-cli npm | From 2.0.0 | 2.0.2 |
Products include Protobufjs Project Protobufjs-Cli.
How do I fix CVE-2026-44295?
Upgrade protobufjs-cli to a fixed version for your release line: 1.2.1 or 2.0.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44295 being exploited?
There is no known exploitation of CVE-2026-44295 in the wild and no public exploit code.
Other vulnerabilities in protobufjs protobuf.js
Sources
Also known as CLEANSTART-2026-XA34946, GHSA-6r35-46g8-jcw9.