protobufjs compiles protobuf definitions into JavaScript functions. In affected versions (<7.5.5 and >=8.0.0-experimental but <8.0.1), attackers can exploit improper control of code generation (CWE-94) by injecting arbitrary code into the "type" fields of protobuf definitions. This code executes during the decoding process, enabling potential remote code execution or other malicious actions. The vulnerability is rated critical with a CVSS 4.0 score of 9.4. Although no direct patch links or vendor advisories are provided, the issue is fixed starting from versions 7.5.5 and 8.0.1.

Successful exploitation allows attackers to execute arbitrary code during protobuf object decoding, which can lead to remote code execution or compromise of the host environment. The vulnerability affects the integrity and security of applications using vulnerable protobuf.js versions, potentially resulting in full system compromise depending on the context of use.

Upgrade protobuf.js to version 7.5.5 or later, or to 8.0.1 or later, as these versions include fixes for this vulnerability. Since no official vendor advisory or patch link is provided, verify the upgrade path with the protobufjs project repository or official channels. Avoid using vulnerable versions in production environments. Patch status is not explicitly confirmed beyond the version numbers stated; check the vendor repository or official protobufjs communications for the latest remediation guidance.