A critical RCE flaw in protobuf.js allows JS code execution via unsafe dynamic function creation from schemas. Affects versions ≤ 8.0.0/7.5.4; upgrade to 8.0.1 or 7.5.5. #RemoteCodeExec #JavaScriptFlaw #EndorLabs
Critical flaw in Protobuf library enables JavaScript code execution
Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js that stems from unsafe dynamic function generation from schemas. Users should upgrade to protobuf.js 8.0.1 or 7.5.5, audit schema sources, and avoid loading untrusted schemas to mitigate the risk. #protobufjs #EndorLabs
www.hendryadrian.com
April 18, 2026 at 7:00 PM
A critical RCE flaw in protobuf.js allows JS code execution via unsafe dynamic function creation from schemas. Affects versions ≤ 8.0.0/7.5.4; upgrade to 8.0.1 or 7.5.5. #RemoteCodeExec #JavaScriptFlaw #EndorLabs