CVE-2026-44295: protobuf.js: Code injection in pbjs static output from crafted schema names

May 12, 2026 (updated May 14, 2026)

pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization.

References

github.com/advisories/GHSA-6r35-46g8-jcw9
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2
github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9
nvd.nist.gov/vuln/detail/CVE-2026-44295

Code Behaviors & Features

Detect and mitigate CVE-2026-44295 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →