Protobuf.js Proto6 CVEs allow code injection, RCE
Key insights
- Six Proto6 CVEs in protobuf.js expose code injection and RCE paths; two score above CVSS 8.0 (8.7 and 8.1).
- Root cause is the library treating schemas and metadata as trusted by default, enabling exploitation via attacker-controlled input.
- Patches released in protobufjs 7.5.6 / 8.0.2 and protobufjs-cli 1.2.1 / 2.0.2 address all six flaws.
Why this matters
Protobuf.js is embedded in Google Cloud client libraries, messaging frameworks like Baileys, and CI/CD pipelines, giving these six CVEs broad blast radius across commonly trusted Node.js infrastructure. The two highest-severity flaws score 8.7 and 8.1, covering code injection in pbjs static output and arbitrary JavaScript execution via the Function() constructor through prototype pollution. The root cause, the library treating schemas and metadata as trusted by default, is an architectural assumption Cyera researchers identified as the common thread across all six vulnerabilities, not a surface-level implementation bug.
Summary
Six protobuf.js vulnerabilities, collectively named Proto6 by Cyera researchers, affect versions up to 7.5.5 and 8.0.0-8.0.1, spanning Google Cloud client libraries, the Baileys messaging framework, CI/CD pipelines, and any Node.js service deserializing Protobuf data.
CVE-2026-44295 (CVSS 8.7) injects code via schema names in pbjs static output. CVE-2026-44291 (CVSS 8.1) achieves arbitrary JavaScript execution through prototype pollution chained with unsafe type resolution and the Function() constructor.
Essentially: (Cyera, protobuf.js) the library trusts schemas and metadata by default, turning attacker-controlled input into a code execution path.
- Patches: protobufjs 7.5.6 / 8.0.2 and protobufjs-cli 1.2.1 / 2.0.2.
- Four additional CVEs cover DoS and prototype injection at lower severity scores.
Teams running Google Cloud Node.js clients or Baileys may not have treated protobuf.js as an active attack surface before this disclosure.
Potential risks and opportunities
Risks
- Google Cloud users running unpatched Node.js services that deserialize external Protobuf data face RCE exposure until protobufjs 7.5.6 or 8.0.2 is deployed and affected code paths are reviewed
- Baileys-based messaging applications processing attacker-controlled input could be compromised via the CVE-2026-44291 prototype pollution chain before teams apply patches
- CI/CD pipelines using protobufjs-cli versions up to 1.2.0 or 2.0.0-2.0.1 to generate static code remain vulnerable to CVE-2026-44295 code injection if schema inputs are not tightly controlled
Opportunities
- Supply-chain security tooling vendors can surface Proto6 as a high-urgency finding across the Node.js ecosystem, driving upgrade adoption at organizations using Google Cloud client libraries
- Security teams at organizations running Google Cloud Node.js clients now have a CVSS-scored, named disclosure to justify schema-input validation controls that were previously deprioritized
- Cyera, as the disclosing researcher, gains credibility in the supply-chain security space and can convert the Proto6 research into enterprise Node.js pipeline security product positioning
What we don't know yet
- Whether Google Cloud's own client library releases have been updated or require separate downstream patches beyond upgrading to protobufjs 7.5.6 / 8.0.2
- No in-the-wild exploitation confirmed or denied in the disclosure, leaving exposure window and urgency timeline uncertain for defenders
- Whether CI/CD pipelines that cached protobufjs-cli-generated static output need to regenerate files post-upgrade to fully eliminate CVE-2026-44295 exposure
Originally reported by thehackernews.com
Read the original article →Original headline: Proto6: Six CVEs in Protobuf.js Enable Code Injection and RCE Across Google Cloud, Node.js Apps, and CI/CD Pipelines