A flaw in protobuf.js allows an attacker to inject executable JavaScript code into a generated toObject conversion function. The injection originates from a schema‑controlled default value on a bytes field that is not a string. When an untrusted protobuf schema is compiled, the resulting JavaScript contains attacker‑controlled code, providing a direct avenue for arbitrary code execution in the environment that runs the conversion function.

The vulnerability affects the protobuf.js library in versions prior to 7.5.6 and 8.0.2. Any application that relies on these older releases and compiles protobuf descriptors from untrusted sources is at risk.

The CVSS score of 7.7 indicates high severity. The EPSS score is not available, but the absence of data does not lower the risk; any system that processes untrusted descriptors exposes a code injection vector. The issue is not listed in the CISA KEV catalog, yet the direct code execution capability makes it a high‑priority problem. The likely attack vector is the delivery of a maliciously crafted protobuf descriptor that an application compiles with protobuf.js.