CVE-2026-44295: protobufjs_project protobufjs-cli Code Injection
Vulnerability summary
CVE-2026-44295 is a high (CVSS 8.7) Code Injection vulnerability in protobufjs_project protobufjs-cli. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 13-05-2026Last modifiedVulnerability information updated.
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- NVDNIST8.7HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
28%
Versus all other CVEs
30-day change
-0.03 pp
From 0.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- vitess-22All versions (No fix recorded)
- vitess-23< 23.0.4-r5
Npm1 product
- protobufjs-cli< 1.2.1 | ≥ 2.0.0, < 2.0.2
Protobufjs1 product
- protobuf.js≥ 2.0.0, < 2.0.2 | < 1.2.1
Protobufjs_project1 product
- protobufjs-cli< 1.2.1 | ≥ 2.0.0, < 2.0.2
Wolfi1 product
- vitess-23< 23.0.4-r5
5 vendors · 6 products
References
6 links- github.com/protobufjs/protobuf.js/security/advisories/GHSA-6r35-46g8-jcw9X Refsource CONFIRMAdvisoryWEBVendor Advisory
