npm package report

Is protobufjs-cli safe?

3 known vulnerabilities, worst severity HIGH.

cvss

8.2

how bad it is if exploited, out of 10

epss

0.30%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-pr59-h9ph-3fr8, the advisory selected below

// advisories

GHSA-pr59-h9ph-3fr8

HIGHCVE-2026-54271

A previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affected.

Affected: >=0, <1.3.2, <= 1.3.1
Fixed in: 1.3.2
Weakness: CWE-94
Published: 2026-06-15
Source: osv

NVD MITRE OSV

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:41 UTC. The most recent advisory here was published 2026-06-15. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is protobufjs-cli safe? npm package security report | CyberXYZ