AIKIDO-2026-202183

TL;DR

The pbf/compile module generates JavaScript reader/writer functions from a parsed protobuf schema and interpolates each field.tag value directly into the generated source that is evaluated with new Function. Field tags were not validated, so a crafted schema supplying a string tag containing JavaScript can inject and execute attacker-controlled code when the schema is compiled. This can lead to arbitrary code execution in the process that compiles an untrusted schema. The fix adds a validateTag check that rejects non-integer tags and tags outside the valid protobuf range before code generation.