The protobuf.js library transforms protobuf definitions into JavaScript functions for decoding messages. In versions older than 8.0.1 and 7.5.5, a malicious actor can insert executable code into the "type" fields of a protobuf definition. When a payload is decoded using that definition, the injected code runs in the context of the application, leading to arbitrary code execution. This flaw is identified as code injection (CWE-94).

The vulnerability affects all deployments of protobuf.js that use a version earlier than 8.0.1 or 7.5.5. The affected product is protobufjs: protobuf.js. Validated mitigations are available in releases 7.5.5 and 8.0.1, which remove the ability to inject code via the "type" field.

The CVSS score of 9.4 indicates a critical severity. Although a current EPSS score is not available, the high CVSS rating and the ability to execute code from user-supplied definitions suggest a high likelihood of exploitation, especially in environments where untrusted protobuf data is parsed. The vulnerability is not listed in CISA’s KEV catalog, but that does not reduce its potential impact. The attack vector is likely local or by delivering malicious protobuf messages to an application that decodes them, making any process with access to such messages a potential target.