pbjs static code generation emits unsafe JavaScript identifiers derived from schema names, enabling an attacker to inject arbitrary JavaScript into the generated output. This injection can lead to remote code execution if the produced code is executed on a system with sufficient privileges.

The vulnerability affects the protobuf.js command line add‑on, protobufjs-cli, specifically versions of pbjs older than 1.2.1 and 2.0.2. Only the static code generation feature is impacted.

The CVSS score of 8.7 categorizes this as a high‑severity flaw. No EPSS score is available and it is not listed in CISA KEV. Exploitation requires delivering a crafted schema or JSON descriptor to the pbjs CLI and subsequently executing the resulting JavaScript; the likely attack vector is a build pipeline or deployment process that consumes third‑party schemas.