High severity · published May 13, 2026
CVE-2026-42290
protobufjs-cli: OS Command Injection
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
protobuf.js · protobufjs
>= 2.0.0, < 2.0.2; < 1.2.1 · source: vendor
PR
Protobufjs-cli · Protobufjs Project
before 1.2.1; 2.0.0 before 2.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42290
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42290
Vendor Advisory
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj
More from protobuf.js
9.8
CVE-2026-41242
protobufjs has an arbitrary code execution issue
8.8
CVE-2026-44293
protobufjs: Code injection through bytes field defaults in generated toObject code
8.7
CVE-2026-44295
protobufjs-cli: Code injection in pbjs static output from crafted schema names
8.1
CVE-2026-44291
protobufjs: Code generation gadget after prototype pollution
7.5
CVE-2026-59877
protobufjs: Denial of Service via infinite loop in .proto option parsing