Preliminary research

Proto6: The Schema Was Not Supposed to Run

Vladimir Tokarev · Cyera Research · 11 September 2026

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Follows schema-derived identifiers into runtime and static JavaScript generation in protobuf tooling. Prototype-inherited lookups admit hostile type names, while identifier escaping, object prototype writes and recursive decoding expose distinct execution and resource boundaries; examples show why schema data needs validation before generated code uses it.

Record

Researcher

Vladimir Tokarev

Published by

Cyera Research

Date

11 September 2026

Topic

Other

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Code generation gadget after prototype pollution Advisory
• Code injection in pbjs static output from crafted schema names Advisory
• Fix: Harden input handling (protobuf.js)
• CVE-2026-44289 Advisory
• CVE-2026-44290 Advisory
• CVE-2026-44292 Advisory
• CVE-2026-44294 Advisory

Tags

• javascript
• prototype-pollution
• injection
• rce
• dos
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Vladimir Tokarev, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 13 September 2026.