CVE-2026-54271: protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

June 15, 2026 (updated July 15, 2026)

A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected.

This is a bypass of GHSA-6r35-46g8-jcw9 / CVE-2026-44295.

References

github.com/advisories/GHSA-pr59-h9ph-3fr8
github.com/protobufjs/protobuf.js/security/advisories/GHSA-pr59-h9ph-3fr8
nvd.nist.gov/vuln/detail/CVE-2026-54271

Code Behaviors & Features

Detect and mitigate CVE-2026-54271 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →