The protobuf.js library compiles protobuf definitions into JavaScript functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, a malicious actor can inject arbitrary code in the "type" fields of protobuf definitions. When the application decodes a message using that definition, the injected code executes in the application’s context, enabling arbitrary code execution. This flaw is a code injection vulnerability (CWE‑94).

The vulnerability affects all deployments of protobuf.js that use a version earlier than 8.0.1 or 7.5.5. The affected product is protobufjs: protobuf.js. Validated mitigations are available in releases 7.5.5 and 8.0.1, which remove the ability to inject code via the "type" field.

The CVSS score of 9.4 indicates a critical severity. The EPSS score of 0.00774 indicates a very low probability that the vulnerability will be exploited in the near term, but the high value still signals that an attacker could achieve arbitrary code execution if the flaw is successfully leveraged. The vulnerability is not listed in CISA’s KEV catalog, but that does not reduce its potential impact. The attack vector is likely local or by delivering malicious protobuf messages to an application that decodes them, making any process with access to such messages a potential target.