High severity · published May 13, 2026
CVE-2026-44295
protobufjs-cli: Code injection in pbjs static output from crafted schema names
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
protobuf.js · protobufjs
>= 2.0.0, < 2.0.2; < 1.2.1 · source: vendor
PR
Protobufjs-cli · Protobufjs Project
before 1.2.1; 2.0.0 before 2.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44295
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44295
Vendor Advisory
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9
More from protobuf.js
9.8
CVE-2026-41242
protobufjs has an arbitrary code execution issue
8.8
CVE-2026-44293
protobufjs: Code injection through bytes field defaults in generated toObject code
8.1
CVE-2026-44291
protobufjs: Code generation gadget after prototype pollution
7.8
CVE-2026-42290
protobufjs-cli: OS Command Injection
7.5
CVE-2026-59877
protobufjs: Denial of Service via infinite loop in .proto option parsing