{"items":[{"id":"NVI-00016190","kind":"vulnerability","title":"protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pr59-h9ph-3fr8","CVE-2026-54271"],"plain_summary":"GitHub lists this reviewed advisory for protobufjs-cli, protobufjs-cli. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-42131a19a8890434a5e36a0261f25ff3"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-15T22:06:59.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-42131a19a8890434a5e36a0261f25ff3"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-42131a19a8890434a5e36a0261f25ff3","url":"https://github.com/advisories/GHSA-pr59-h9ph-3fr8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pr59-h9ph-3fr8","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T09:59:43.724Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-42131a19a8890434a5e36a0261f25ff3"],"technology":"protobufjs-cli","known_exclusions":[],"conditions_summary":"## Summary\n\nA previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from `.proto` files is not affected.\n\nThis is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295.\n\n## Impact\n\nAn attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may be able to cause generated JavaScript output to contain attacker-controlled code.\n\nThe injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked.\n\n## Preconditions\n\n* The application or build process must run `pbjs` static code generation on a pre-parsed JSON descriptor influenced by an attacker.\n* The generated JavaScript file must subsequently be executed or imported.\n* An affected generated API path must be invoked.\n\n## Workarounds\n\nDo not run affected versions of `pbjs` static or static-module generation on untrusted JSON descriptors. If untrusted JSON descriptors must be accepted, validate descripto","public_affected_ranges":["<= 1.3.1"]},{"certainty":"source_listed","source_ids":["sr-42131a19a8890434a5e36a0261f25ff3"],"technology":"protobufjs-cli","known_exclusions":[],"conditions_summary":"## Summary\n\nA previous fix for unsafe name handling in `pbjs` static / static-module code generation was incomplete. Affected versions of `protobufjs-cli` could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from `.proto` files is not affected.\n\nThis is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295.\n\n## Impact\n\nAn attacker who can provide or influence pre-parsed JSON descriptors passed to `pbjs` static code generation may be able to cause generated JavaScript output to contain attacker-controlled code.\n\nThe injected code may execute if the generated file is later executed or imported and an affected generated API path is invoked.\n\n## Preconditions\n\n* The application or build process must run `pbjs` static code generation on a pre-parsed JSON descriptor influenced by an attacker.\n* The generated JavaScript file must subsequently be executed or imported.\n* An affected generated API path must be invoked.\n\n## Workarounds\n\nDo not run affected versions of `pbjs` static or static-module generation on untrusted JSON descriptors. If untrusted JSON descriptors must be accepted, validate descripto","public_affected_ranges":[">= 2.0.0, <= 2.4.2"]}],"null_published_at":"2026-11-04T10:04:27.903Z","source_updated_at":"2026-07-15T22:06:59.000Z","source_disclosed_at":"2026-06-15T20:13:54.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T09:59:43.724Z"}],"next_cursor":null,"snapshot_revision":"42594"}