Critical RCE vulnerability in protobuf.js library
Critical flaw in widely used Protocol Buffers library
Proof-of-concept exploit code has been published for a critical remote code execution vulnerability in protobuf.js, a JavaScript implementation of Google's Protocol Buffers with nearly 50 million weekly downloads from npm.
Technical details of the vulnerability
The vulnerability (tracked as GHSA-xq3m-2v4x-88gg) is caused by unsafe dynamic code generation. The library builds JavaScript functions from protobuf schemas by concatenating strings and executing them via the Function() constructor, but fails to validate schema-derived identifiers like message names.
This allows an attacker to supply a malicious schema that injects arbitrary code into the generated function, which executes when the application processes a message using that schema.
Impact and affected versions
- Affects protobuf.js versions 8.0.0/7.5.4 and lower
- Enables RCE on servers or applications loading attacker-influenced schemas
- Can grant access to environment variables, credentials, databases, and internal systems
- Allows lateral movement within infrastructure
- Could affect developer machines loading untrusted schemas locally
Patches and recommendations
Upgrade to patched versions:
- 8.0.1 for the 8.x branch (released to npm on April 4)
- 7.5.5 for the 7.x branch (released to npm on April 15)
The patch sanitizes type names by stripping non-alphanumeric characters, preventing attackers from closing the synthetic function. Endor Labs notes that a longer-term fix would be to stop round-tripping attacker-reachable identifiers through Function entirely.
Additional recommendations from Endor Labs:
- Audit transitive dependencies
- Treat schema-loading as untrusted input
- Prefer precompiled/static schemas in production
Timeline and status
- Vulnerability reported by Endor Labs researcher Cristian Staicu on March 2
- Patch released on GitHub on March 11
- npm packages updated in April
- No active exploitation observed to date
- Exploitation described as "straightforward" with minimal PoC available
📖 Read the full source: HN AI Agents
👀 See Also
Rules of the Claw: Open Source Security Rule Set for OpenClaw Agents
An open source JSON rule set with 139 security rules that blocks destructive commands, protects credential files, and guards instruction files from unauthorized agent edits. It operates with zero LLM dependency using regex patterns at the tool layer.
RunLobster Hosting Warning: Bot Spam and Unauthorized Charges Reported
A Reddit user reports RunLobster (OpenClaw Hosting) bots spamming tech subreddits and hitting their card with three unauthorized charges immediately after registration, with no response from support.
Anthropic's Computer-Use Feature Triggers Governance Lockdown in Real Test
Anthropic shipped computer-use capabilities, and during implementation of governance controls, a risk threshold triggered a LOCKDOWN posture that blocked all mutating operations including the operator's own governance work.
llm-hasher: Local PII Detection and Tokenization for Hybrid LLM Workflows
llm-hasher is a tool that detects personally identifiable information locally using Ollama before data reaches external LLMs like OpenAI or Claude, tokenizes the PII, and restores originals after processing. It uses regex for structured data types and a local LLM for contextual detection, with encrypted storage for mappings.