52M-Download protobuf.js Library Hit by RCE in Schema Handling
Critical RCE vulnerability in protobuf.js library affects 52M weekly downloads via schema handling flaw.
Endor Labs discovered a critical remote code execution (RCE) vulnerability (GHSA-xq3m-2v4x-88gg, CVSS 9.4) in protobuf.js, a widely-used JavaScript library that processes Protocol Buffer schemas. The flaw stems from unsafe use of the Function constructor to dynamically generate code without filtering malicious input in schema names, allowing attackers to inject executable JavaScript. Affected versions are protobufjs 8.0.0 and earlier, and 7.5.4 and earlier; a patch was released in April 2026 via a single-line fix that sanitizes type names.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical remote code execution vulnerability was discovered in protobuf.js, a widely-used JavaScript library with over 52 million downloads, caused by unsafe use of the Function constructor that allows malicious code injection through schema names. This demonstrates how third-party dependencies can introduce severe security risks into applications, as the library dynamically generated code without proper input validation or sanitization. The vulnerability highlights the importance of supply chain security, as a single compromised library can affect countless downstream applications that depend on it. Organizations must implement robust dependency management practices to detect and respond to such vulnerabilities in their software supply chain.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.