Critical RCE vulnerability in protobuf.js library
Critical flaw in widely used Protocol Buffers library
Proof-of-concept exploit code has been published for a critical remote code execution vulnerability in protobuf.js, a JavaScript implementation of Google's Protocol Buffers with nearly 50 million weekly downloads from npm.
Technical details of the vulnerability
The vulnerability (tracked as GHSA-xq3m-2v4x-88gg) is caused by unsafe dynamic code generation. The library builds JavaScript functions from protobuf schemas by concatenating strings and executing them via the Function() constructor, but fails to validate schema-derived identifiers like message names.
This allows an attacker to supply a malicious schema that injects arbitrary code into the generated function, which executes when the application processes a message using that schema.
Impact and affected versions
- Affects protobuf.js versions 8.0.0/7.5.4 and lower
- Enables RCE on servers or applications loading attacker-influenced schemas
- Can grant access to environment variables, credentials, databases, and internal systems
- Allows lateral movement within infrastructure
- Could affect developer machines loading untrusted schemas locally
Patches and recommendations
Upgrade to patched versions:
- 8.0.1 for the 8.x branch (released to npm on April 4)
- 7.5.5 for the 7.x branch (released to npm on April 15)
The patch sanitizes type names by stripping non-alphanumeric characters, preventing attackers from closing the synthetic function. Endor Labs notes that a longer-term fix would be to stop round-tripping attacker-reachable identifiers through Function entirely.
Additional recommendations from Endor Labs:
- Audit transitive dependencies
- Treat schema-loading as untrusted input
- Prefer precompiled/static schemas in production
Timeline and status
- Vulnerability reported by Endor Labs researcher Cristian Staicu on March 2
- Patch released on GitHub on March 11
- npm packages updated in April
- No active exploitation observed to date
- Exploitation described as "straightforward" with minimal PoC available
📖 Read the full source: HN AI Agents
👀 See Also
AI System Discovers 12 OpenSSL Zero-Days, Curl Cancels Bug Bounty Due to AI Spam
AISLE's AI system discovered all 12 zero-day vulnerabilities in OpenSSL's recent security release, marking the first large-scale demonstration of AI-based cybersecurity. Meanwhile, curl cancelled its bug bounty program due to AI-generated spam submissions.
5 Malicious OpenClaw Skills That Passed ClawScan + VirusTotal: Unit 42 Analysis
Unit 42 found 5 malicious OpenClaw skills that bypassed ClawScan and VirusTotal. Techniques included runtime referral swapping, SOL pooling for pump-and-dump, and 22MB README padding to hide an AMOS dropper.
arifOS: A $15 MCP Governance Kernel for OpenClaw Tool Security
arifOS is a lightweight MCP server that intercepts OpenClaw tool calls, scores them 000-999, and blocks unsafe actions with 13 hard security floors before they reach filesystems, APIs, or databases.
AI Agent Security: Token Budget Determines Data Exfiltration Risk
A developer tested AI agents connected to Gmail: frontier models caught phishing, mid-tier was unstable, cheap models silently forwarded malicious emails. Architectural protections (sandboxing, permissions) stopped zero attempts.