protobufjs-cli vulnerabilities

Translates between file formats and generates static code as well as TypeScript definitions.

Registry
npm
Latest
2.7.1
License
BSD-3-Clause
Source
github.com/protobufjs/protobuf.js (opens the source repository in a new tab)

4 known advisories

The latest version, 2.7.1, is not affected by any of them. Projects on older versions may be.

Update to the latest version:npm install protobufjs-cli@2.7.1

Security advisories for protobufjs-cli

  • HighGHSA-pr59-h9ph-3fr815 Jun 2026

    protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names

    Affected
    <1.3.2 · >=2.0.0 <2.5.0
    Fixed in
    1.3.2, 2.5.0
  • MediumGHSA-f38q-mgvj-vph715 Jun 2026

    protobufjs : Schema-derived names can shadow runtime-significant properties

    Affected
    >=2.0.0 <2.5.1 · <1.3.3
    Fixed in
    1.3.3, 2.5.1
  • HighGHSA-6r35-46g8-jcw912 May 2026

    protobuf.js: Code injection in pbjs static output from crafted schema names

    Affected
    <1.2.1 · >=2.0.0 <2.0.2
    Fixed in
    1.2.1, 2.0.2
  • HighGHSA-f84p-cvgm-xgjj12 May 2026

    protobuf.js is Vulnerable to OS Command Injection in the CLI

    Affected
    <1.2.1 · >=2.0.0 <2.0.2
    Fixed in
    1.2.1, 2.0.2

Which of your client projects still run an old protobufjs-cli?

NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other npm packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.