Search: CVE-2026-44295

CVE-2026-44295 is a high-severity vulnerability in protobufjs-cli, the command line add-on for protobuf.js. Before versions 1.2.1 and 2.0.2, the static code generation feature (pbjs) could produce unsafe JavaScript identifiers derived from schema-controlled names without proper sanitization. This flaw allows crafted schemas or JSON descriptors to inject unsafe code into the generated JavaScript output. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code). It has a CVSS v3.