Preliminary research

Proto6: The Schema Was Not Supposed to Run

Vladimir Tokarev · Cyera Research · 11 September 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Follows schema-derived identifiers into runtime and static JavaScript generation in protobuf tooling. Prototype-inherited lookups admit hostile type names, while identifier escaping, object prototype writes and recursive decoding expose distinct execution and resource boundaries; examples show why schema data needs validation before generated code uses it.

Record

Researcher

Vladimir Tokarev

Published by

Cyera Research

Date

11 September 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Runtime code-generation advisory
• Static-output advisory
• Fix
• Detailed vulnerability advisory
• Detailed vulnerability advisory
• Detailed vulnerability advisory
• Detailed vulnerability advisory

Tags

• javascript
• prototype-pollution
• injection
• rce
• dos
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Vladimir Tokarev, first published at the original source. Preserved copies are kept so the citation survives its host.