TLDR Tech / InfoSec
The Dangers of Reusing Protobuf Definitions: Critical Code Execution in protobuf.js (GHSA-xq3m-2v4x-88gg)
Endor Labs discovered a critical remote code execution vulnerability (GHSA-xq3m-2v4x-88gg, CVSS 9.4) in protobuf.js, a widely deployed serialization library often transitively included via @grpc/proto-loader, Firebase, and Google Cloud SDKs. The flaw exists because the library concatenates unvalidated schema type names directly into JavaScript source code and evaluates them via the Function constructor, allowing attackers who supply a malicious configuration file to achieve unauthenticated code execution when the target application processes its first message. Defenders must immediately upgrade to protobufjs 8.0.1 or 7.5.5, audit transitive dependencies, and treat dynamic schema-loading endpoints like Root.fromJSON as untrusted execution surfaces.
Read the full story