Critical RCE vulnerability in protobuf.js library
Critical flaw in widely used Protocol Buffers library
Proof-of-concept exploit code has been published for a critical remote code execution vulnerability in protobuf.js, a JavaScript implementation of Google's Protocol Buffers with nearly 50 million weekly downloads from npm.
Technical details of the vulnerability
The vulnerability (tracked as GHSA-xq3m-2v4x-88gg) is caused by unsafe dynamic code generation. The library builds JavaScript functions from protobuf schemas by concatenating strings and executing them via the Function() constructor, but fails to validate schema-derived identifiers like message names.
This allows an attacker to supply a malicious schema that injects arbitrary code into the generated function, which executes when the application processes a message using that schema.
Impact and affected versions
- Affects protobuf.js versions 8.0.0/7.5.4 and lower
- Enables RCE on servers or applications loading attacker-influenced schemas
- Can grant access to environment variables, credentials, databases, and internal systems
- Allows lateral movement within infrastructure
- Could affect developer machines loading untrusted schemas locally
Patches and recommendations
Upgrade to patched versions:
- 8.0.1 for the 8.x branch (released to npm on April 4)
- 7.5.5 for the 7.x branch (released to npm on April 15)
The patch sanitizes type names by stripping non-alphanumeric characters, preventing attackers from closing the synthetic function. Endor Labs notes that a longer-term fix would be to stop round-tripping attacker-reachable identifiers through Function entirely.
Additional recommendations from Endor Labs:
- Audit transitive dependencies
- Treat schema-loading as untrusted input
- Prefer precompiled/static schemas in production
Timeline and status
- Vulnerability reported by Endor Labs researcher Cristian Staicu on March 2
- Patch released on GitHub on March 11
- npm packages updated in April
- No active exploitation observed to date
- Exploitation described as "straightforward" with minimal PoC available
📖 Read the full source: HN AI Agents
👀 See Also
Agent Isolation Security Analysis: From No Sandbox to Firecracker VMs
Analysis of how Cursor, Claude Code, Devin, OpenAI, and E2B isolate agent workloads, ranging from no sandbox to hardware-isolated Firecracker microVMs. Container runtimes have had escape CVEs annually since 2019, while Firecracker has zero guest-to-host escapes in seven years.
Security scan reveals high severity finding in AI agent find-skills tool
A developer running a security scan on their AI agent setup discovered a high severity vulnerability in the find-skills tool they used to install additional skills, raising concerns about ecosystem safety.
OpenClaw Skill Safety Scanner: 7.6% of 31,371 Skills Flagged as Dangerous
A developer built a tool that scanned the entire ClawHub registry and found 2,371 out of 31,371 skills contain dangerous patterns like wallet drainers, credential theft, and prompt injection. The tool provides API access and badges for checking skills before installation.
Microsoft's Open Source Tools Hacked: Password-Stealing Malware Hits AI Developer Repos
Hackers injected password-stealing malware into at least 70 Microsoft GitHub repos, targeting AI developers using Claude Code, Gemini CLI, and VS Code. This is a re-compromise of the earlier Durable Task breach.