CVE-2026-42290
CVE-2026-42290 · protobufjs-cli: OS Command Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVSS 7.8 · High · EPSS 0.1% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
protobuf.js
- Versions
- >= 2.0.0, < 2.0.2: Affected
- < 1.2.1: Affected
No fix published
protobufjs-cli npm
- Affected ranges
- SEMVER: < 1.2.1
Update to 1.2.1
protobufjs-cli npm
- Affected ranges
- SEMVER: ≥ 2.0.0, < 2.0.2
Update to 2.0.2