CVE-2026-54271 Overview
CVE-2026-54271 is a code injection vulnerability [CWE-94] in protobufjs-cli, the command-line add-on for protobuf.js. The flaw affects the pbjs static and static-module code generators when processing crafted JSON descriptor input. Affected versions emit unsafe JavaScript references that allow attacker-controlled code to appear in generated output. This issue is a bypass of the prior fix for CVE-2026-44295. Parsing schemas from .proto files is not affected. Maintainers resolved the flaw in versions 1.3.2 and 2.5.0.
Critical Impact
Attackers who supply or influence pre-parsed JSON descriptors passed to pbjs static code generation can cause the generated JavaScript to contain injected code that executes when the file is later imported or its generated API is invoked.
Affected Products
- protobufjs-cli versions prior to 1.3.2 (1.x branch)
- protobufjs-cli versions prior to 2.5.0 (2.x branch)
- Node.js build pipelines that consume untrusted JSON descriptors with pbjs --target static or static-module
Discovery Timeline
- 2026-06-22 - CVE-2026-54271 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-54271
Vulnerability Analysis
The vulnerability resides in the static code generation path of protobufjs-cli. When pbjs produces static JavaScript output from a Protocol Buffers schema, it embeds names from the schema into the generated source. The prior remediation for CVE-2026-44295 sanitized common name-handling paths but did not cover every code path that emits identifiers into generated JavaScript. An attacker who controls the schema input can shape names so that generated output contains executable JavaScript rather than safe string references. Because the injected code lands inside a build artifact, it executes in the context of any process that later loads the generated module. Build servers, CI pipelines, and downstream consumers of the produced JavaScript inherit the risk.
Root Cause
The root cause is incomplete neutralization of special elements used in code generation [CWE-94]. Identifier emission in the static/static-module generator does not fully validate or escape names obtained from JSON descriptors, allowing crafted values to break out of expected reference contexts and become arbitrary source tokens in the output file.
Attack Vector
Exploitation requires the victim to invoke pbjs static code generation against a JSON descriptor the attacker provides or influences. Typical scenarios include build systems that accept descriptors from third-party repositories, automated tooling that converts user-submitted schemas, or supply-chain workflows that aggregate .json schema files from external sources. The common case of compiling .proto files is not impacted. Code execution occurs at the time the generated artifact is imported or its affected API path is invoked, not at generation time.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-pr59-h9ph-3fr8 for vendor technical detail.
Detection Methods for CVE-2026-54271
Indicators of Compromise
- Generated pbjs static output containing unexpected function calls, template literals, or identifier sequences that do not match schema field names.
- Build logs showing pbjs --target static or pbjs --target static-module invoked against JSON descriptors from untrusted sources.
- Node.js processes spawning unexpected child processes shortly after loading a generated protobuf module.
Detection Strategies
- Perform static review or diff analysis of generated .js artifacts against the JSON descriptor input, flagging identifiers that contain non-identifier characters.
- Inventory installed protobufjs-cli versions across developer workstations and build agents, alerting on versions earlier than 1.3.2 or 2.5.0.
- Add software composition analysis (SCA) rules in CI that fail builds when vulnerable protobufjs-cli versions are present.
Monitoring Recommendations
- Monitor CI/CD runners for outbound network activity and process executions occurring during or immediately after pbjs build steps.
- Audit any pipeline stage that converts .proto to JSON and then feeds JSON back to pbjs, since this pattern reintroduces the attacker-controlled descriptor path.
- Track package-lock changes that pin protobufjs-cli and alert on downgrades below the patched versions.
How to Mitigate CVE-2026-54271
Immediate Actions Required
- Upgrade protobufjs-cli to 1.3.2 on the 1.x branch or 2.5.0 on the 2.x branch.
- Rebuild and republish any JavaScript artifacts previously generated by vulnerable pbjs versions from JSON descriptors.
- Treat all JSON descriptors from external or user-controlled sources as untrusted input and review them before code generation.
Patch Information
The maintainers fixed the issue in protobufjs-cli1.3.2 and 2.5.0. The patch completes the name-sanitization coverage that the earlier fix for CVE-2026-44295 left incomplete. See the GitHub Security Advisory GHSA-pr59-h9ph-3fr8 for the authoritative patch notes.
Workarounds
- Generate static modules only from trusted .proto schema files, which the advisory confirms are not affected.
- Avoid passing pre-parsed JSON descriptors from untrusted origins to pbjs static or static-module generators.
- Isolate code generation steps inside ephemeral, network-restricted build containers to limit blast radius if injection occurs.
# Configuration example: upgrade and verify protobufjs-cli
npm install --save-dev protobufjs-cli@^2.5.0
npx pbjs --version
# Prefer .proto input over JSON descriptors
npx pbjs --target static-module --wrap commonjs --out bundle.js schema.proto
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
