Original link: Critical flaw in Protobuf library enables JavaScript code execution / BleepingComputer.
Remember that protobuf format is not only custom serialization/deserialization - it is also the transformat format for gRPC!