The protobufjs library compiles protobuf definitions into JavaScript functions. In affected versions (<7.5.6 and >=8.0.0 <8.0.2), the toObject conversion function generation process can include unsafe expressions derived from bytes field default values controlled by the schema. If a crafted descriptor uses a non-string default value for a bytes field, this can lead to attacker-controlled code being injected into the generated JavaScript function, constituting a code injection vulnerability (CWE-94). This vulnerability is addressed in protobufjs versions 7.5.6 and 8.0.2.

Successful exploitation could allow an attacker with the ability to supply crafted protobuf descriptors to inject arbitrary JavaScript code into the generated toObject conversion functions. This could lead to execution of attacker-controlled code within the context of the application using protobuf.js, potentially compromising application integrity and security. No known exploits in the wild have been reported.

Upgrade protobufjs to version 7.5.6 or later, or to version 8.0.2 or later, where this vulnerability is fixed. Patch status is not explicitly stated in the advisory, but these versions contain the fix. Users should verify their protobuf.js version and update accordingly to mitigate this vulnerability.