protobufjs-cli: OS Command Injection
Priority LOW 35CWE-78Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Fixed protobuf.js (protobufjs): 2.0.2, 1.2.1protobufjs-cli (npm): 1.2.1, 2.0.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| protobufjs | protobuf.js | 2.0.0 to before 2.0.2; before 1.2.1 | 2.0.2, 1.2.1 | Patch available | CNA |
| — | protobufjs-cli (npm) | before 1.2.1 | 1.2.1 | Patch available | GHSA-f84p-cvgm-xgjj |
| — | protobufjs-cli (npm) | 2.0.0 to before 2.0.2 | 2.0.2 | Patch available | GHSA-f84p-cvgm-xgjj |
- protobuf.js Vendorprotobufjs Affected 2.0.0 to before 2.0.2; before 1.2.1 Fixed in 2.0.2, 1.2.1 Patch available CNA
- protobufjs-cli (npm) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-f84p-cvgm-xgjj
- protobufjs-cli (npm) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-f84p-cvgm-xgjj
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:protobufjs_project:protobufjs-cli:*:*:*:*:*:node.js:*:* | before 1.2.1; 2.0.0 to before 2.0.2 | Vulnerable | protobufjs |
- cpe:2.3:a:protobufjs_project:protobufjs-cli:*:*:*:*:*:node.js:*:* Versions before 1.2.1; 2.0.0 to before 2.0.2 Vulnerable ·protobufjs
Remediation
- Fix · CNA protobuf.js (protobufjs) Fixed in 2.0.2, 1.2.1
- Fix · GHSA-f84p-cvgm-xgjj protobufjs-cli (npm) Fixed in 1.2.1 Advisory →
- Fix · GHSA-f84p-cvgm-xgjj protobufjs-cli (npm) Fixed in 2.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42290
- 2026-10-03 Alias added: GHSA-f84p-cvgm-xgjj
References
Advisory 2
More Protobufjs-cli vulnerabilities
- TI-2026-32266 protobufjs-cli: Code injection in pbjs static output from crafted schema names CVSS 3.1HIGH 8.7
- TI-2026-39171 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names CVSS 3.1HIGH 8.2
- TI-2026-39169 protobufjs: Schema-derived names can shadow runtime-significant properties CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-42290 · CVE Program
- CVE-2026-42290 · NVD
- FIRST EPSS
- GHSA-f84p-cvgm-xgjj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences