Schema as Weapon: Six Flaws in protobuf.js Open a Path to Remote Code Execution
Cyera researchers found that protobuf.js — pulled into apps 50 million times a week — will, under exploitable conditions, turn schema metadata into running code.
Schemas are supposed to describe data. In protobuf.js, they can execute it.
Cyera researchers Assaf Morag and Vladimir Tokarev disclosed six vulnerabilities in the JavaScript implementation of Google's Protocol Buffers serialization format this week, covering remote code execution, denial-of-service, prototype pollution, and prototype injection. The library sits inside gRPC tooling, Google Cloud SDKs, and a long tail of frameworks — often as a transitive dependency that nobody explicitly pulled in.
The most severe finding, CVE-2026-44291, lives in how protobuf.js generates encoder and decoder functions at runtime. The library compiles those functions using JavaScript's Function() constructor. If an attacker can influence schema-derived values — through prototype pollution, tracked separately as CVE-2026-44292 — they can slip attacker-controlled strings into that constructor and get them executed inside the Node.js process. Schema becomes payload.
A second code-injection issue, CVE-2026-44295, hits the pbjs command-line tool rather than the runtime library. Crafted schema names embed into the JavaScript files pbjs generates. When those files are later imported, the injected code runs. Build pipelines that automatically process protobuf schemas — and most do — are the threat model here.
The remaining three bugs, CVE-2026-44289, CVE-2026-44290, and CVE-2026-44294, are denial-of-service conditions: malformed inputs crash or exhaust resources. Less dramatic, still worth patching.
The precondition for the worst-case scenarios is attacker influence over a protobuf schema or descriptor. That used to sound restrictive. It sounds less so when you consider that schemas travel through CI/CD pipelines, shared repositories, cloud APIs, and third-party integrations as a matter of routine — particularly in data-heavy and AI infrastructure where services exchange schemas constantly and automatically.
MFA doesn't help here. This isn't a credential problem. It's a data-trust problem: the library processes schema inputs without adequately validating them before handing them to a code-generation path.
Patches exist. protobuf.js 7.5.6 and 8.0.2 address the runtime vulnerabilities; protobuf.js-cli users need 1.2.1 or 2.0.2. The harder task is knowing the library is present at all — organizations that haven't audited transitive dependencies may not realize they're running an affected version until they do a full software bill of materials scan.
