Protocol Buffer flaw turns schemas into remote code execution risks
Cyera researchers uncovered six vulnerabilities, including a remote code execution flaw, in protobuf.js, a widely used JavaScript implementation of Google's Protocol Buffers. These vulnerabilities can allow attacker-controlled schema data to become executable code, impacting downstream software supply chains and systems that exchange schemas and configurations, particularly in data and AI ecosystems. Patches are available for protobuf.js versions 7.5.6 and 8.0.2 to address these issues.
Key Takeaways
- Six vulnerabilities, including RCE (CVE-2026-44291), prototype pollution, prototype injection, and denial-of-service (DoS) conditions, were found in protobuf.js versions 7.5.5 and earlier, and 8.0.0, 8.0.1.
- The most critical RCE flaw allows schema-derived information to be manipulated, leading to dynamic code generation and execution within Node.js processes.
- Attackers can exploit weaknesses in schema-handling to inject malicious data, impacting applications that exchange schemas or configurations.
- protobuf.js, downloaded over 50 million times weekly, is often a transitive dependency, making organizations vulnerable without direct awareness.
- Patches are released in protobuf.js 7.5.6 and 8.0.2, and protonufjs-cli 1.2.1 or 2.0.2, to address these issues.
Why It Matters
This vulnerability highlights a critical security risk within widespread data exchange protocols, particularly for systems reliant on protobuf.js in streaming and AI applications. The ability to turn schema data into executable code opens avenues for supply chain attacks that can compromise sensitive data operations. Companies relying on Google Cloud libraries, gRPC tooling, or other frameworks that implicitly use protobuf.js must prioritize updating to patched versions immediately to prevent potential remote code execution. Vigilance regarding transitive dependencies and secure schema validation processes is now paramount for maintaining system integrity.
Additional Context
The critical remote code execution vulnerability in protobuf.js (GHSA-xq3m-2v4x-88gg), also identified by other researchers, carries a CVSS score of 9.4, underscoring its severity. Endor Labs highlighted in April 2026 that protobuf.js is downloaded approximately 52 million times weekly and is often an indirect dependency of widely used platforms like gRPC, Firebase, and Google Cloud SDKs. Their analysis confirms that exploitation requires an attacker to supply a malicious protobuf schema, a condition increasingly prevalent in dynamic data environments. While no public exploits have been reported, Endor Labs emphasizes the attack's straightforward nature. Further, the Cyber Security Agency of Singapore issued an alert in April 2026, advising immediate updates for affected products due to the RCE potential. This incident underscores a broader trend where developer tools can become code-execution primitives when processing untrusted inputs. Google's official Protocol Buffers GitHub page lists various other security advisories, predominantly addressing Denial of Service issues in protobuf-php (March 2026), protobuf-python (June 2025), and protobuf-java (September 2024), indicating ongoing security challenges across different language implementations of Protocol Buffers.
Read full article at infoworld.com
Get this in your inbox → Subscribe
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source