Skip to content
OpenAdvisories

Package · npm

protobufjs-cli

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-54271

    protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

    protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript …

    protobufjs protobufjs-cli protobufjs-cli npm
  • High 8.7
    CVE-2026-44295

    protobufjs-cli: Code injection in pbjs static output from crafted schema names

    protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON des…

    protobufjs protobuf.js protobufjs-cli npm
  • High 7.8
    CVE-2026-42290

    protobufjs-cli: OS Command Injection

    protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could ther…

    protobufjs protobuf.js protobufjs-cli npm