Home

Description

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.

PUBLISHED Reserved 2026-04-26 | Published 2026-05-13 | Updated 2026-05-18 | Assigner GitHub_M




HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

>= 2.0.0, < 2.0.2
affected

< 1.2.1
affected

References

github.com/...buf.js/security/advisories/GHSA-f84p-cvgm-xgjj

cve.org (CVE-2026-42290)

nvd.nist.gov (CVE-2026-42290)

Download JSON