CVE-2026-42290 Details
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
A command injection vulnerability has been identified in protobufjs-cli versions prior to 1.2.1 and 2.0.2. The issue arises in the 'pbts' command, which invokes JSDoc by creating a shell command string from input file paths and executing it via 'child_process.exec'. This approach allows file paths containing shell metacharacters to be interpreted by the shell, rather than being passed to JSDoc as plain arguments. As a result, an attacker could potentially execute arbitrary shell commands with the privileges of the process running 'pbts'.
Users can upgrade to protobufjs-cli versions 1.2.1 or 2.0.2 to address this vulnerability. If an immediate upgrade is not possible, avoid running 'pbts' on file paths controlled by an attacker, or sanitize input files before use. Alternatively, the CLI can be run in a restricted environment with limited privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| protobufjs project protobufjs-cli | < 1.2.1 >= 2.0.0, < 2.0.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |