8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44295

CVE-2026-44295: protobufjs-cli: Code injection in pbjs static output from crafted schema names

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generation could emit unsafe JavaScript identifiers derived from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain namespace, enum, service, or derived full names could be written into the generated output without sufficient sanitization. This vulnerability is fixed in 1.2.1 and 2.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44295

CVE-2026-44295:

8.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs-cli	npm	<= 1.2.0	1.2.1
protobufjs-cli	npm	>= 2.0.0, <= 2.0.1	2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the static code generation feature of pbjs, the command-line interface for protobuf.js. When pbjs generates static JavaScript files from a protobuf schema, it uses names from the schema (like message names, field names, etc.) to create identifiers (variable and function names) in the output JavaScript code. The vulnerability exists because these names were not properly sanitized before being written into the generated code. An attacker could craft a schema with malicious names containing arbitrary JavaScript code. When pbjs processes this schema, the malicious code is injected into the output file. If this generated file is later executed or imported by an application, the injected code runs, leading to a code injection vulnerability.

The analysis of the security patches shows two key functions that were fixed to address this issue:

escapeName in cli/targets/static.js: This function is directly responsible for making schema names safe to use as identifiers in the generated static code. The original implementation was insufficient as it only checked for reserved JavaScript keywords, but allowed other special characters that could be used to terminate a string and inject new code.
codegen in lib/codegen/index.js (and its equivalent in src/util/codegen.js for other versions): This is a more generic utility for creating functions dynamically. It was also found to be vulnerable as it did not sanitize the provided function name. This could be exploited if a schema name was used to define a function name passed to this utility.

The patches for both affected version ranges introduce robust sanitization in these functions, primarily by removing any characters that are not valid in a JavaScript identifier. This ensures that even if a schema contains malicious names, they cannot be used to inject code into the generated output.

Vulnerable functions

escapeName

cli/targets/static.js

The function `escapeName` in `cli/targets/static.js` is responsible for sanitizing identifiers used in the generated static JavaScript code. The vulnerable version only checked for reserved keywords, allowing code to be injected through crafted schema names containing special characters. For example, a name like `a);require('child_process').execSync('touch /tmp/pwned');(function(` would result in arbitrary command execution when the generated code is executed. The patch fixes this by stripping non-alphanumeric characters from the name.

codegen

lib/codegen/index.js

The `codegen` function is a utility for dynamically generating JavaScript functions. The name of the generated function was not sanitized. If an attacker can control the function name (e.g., through a schema element name), they could inject arbitrary code. The patch introduces `safeFunctionName` to sanitize the function name before it's used in the generated code.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.