A flaw in protobufjs-cli’s pbjs static code generation allows crafted JSON descriptor names to be written directly into emitted JavaScript, creating arbitrary executable code. The weakness is a code injection failure (CWE‑94). If the generated file is later executed or imported and an affected API function is called, the injected code runs, giving the attacker arbitrary control over the target environment.

All protobufjs-cli releases prior to 1.3.2 and 2.5.0 are vulnerable when generating static or static‑module output. The common workflow of parsing .proto files directly is not affected.

The CVSS score of 8.2 marks this as a high‑severity vulnerability. It is not listed in the CISA KEV catalog and no public exploit exists. Exploitation requires the attacker to supply or tamper with the pre‑parsed JSON descriptor used by pbjs. This typically demands access to the build environment or control over upstream descriptor distribution, after which the injected code will execute upon loading or calling the generated API.