CVE-2026-54271 is a code injection vulnerability classified under CWE-94 in protobufjs-cli. The issue arises from incomplete fixes for unsafe name handling during static code generation, allowing an attacker who can supply or influence pre-parsed JSON descriptors to cause the tool to emit malicious JavaScript code. This malicious code may execute if the generated file is later run or imported and the vulnerable API path is triggered. The vulnerability specifically affects protobufjs-cli versions prior to 1.3.2 and 2.5.0. It does not impact the typical use case of parsing schemas from .proto files. This vulnerability bypasses a previous fix (CVE-2026-44295) and has been addressed in versions 1.3.2 and 2.5.0.

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript code via malicious JSON descriptors used in static code generation. This can lead to full compromise of the environment where the generated code is run or imported. The vulnerability does not affect parsing from .proto files, limiting the attack vector to scenarios where pre-parsed JSON descriptors are supplied or influenced by an attacker.

This vulnerability is fixed in protobufjs-cli versions 1.3.2 and 2.5.0. Users should upgrade to at least one of these versions to remediate the issue. Since this is not a cloud service, remediation requires updating the affected software. Patch status is confirmed by the vendor advisory stating the fix in these versions.