protobuf.js converts protobuf definitions into JavaScript functions. Prior to versions 7.5.6 and 8.0.2 the library used plain objects with inherited prototypes for its internal lookup tables in generated encode and decode functions. If Object.prototype had been polluted, these lookup tables could treat attacker‑controlled inherited properties as valid protobuf type information, causing attacker‑controlled strings to be embedded directly into the generated JavaScript code. The vulnerability is a code‑generation gadget (CWE‑94) that can result in remote code execution if the produced code is executed in a privileged context.

The affected product is protobuf.js from the protobufjs project. Versions prior to 7.5.6 and prior to 8.0.2 are vulnerable.

The CVSS score of 8.1 reflects high severity. No EPSS data is available, and the vulnerability is not listed in CISA KEV. Exploitation requires that an attacker can supply a malicious protobuf definition or otherwise trigger the library’s compile routine while Object.prototype remains polluted. The likely attack vector is user‑supplied protocol descriptors completed in a runtime environment that evaluates the compiled code, resulting in arbitrary JavaScript execution. The risk is bounded to environments that compile untrusted schema definitions with older versions of protobuf.js.