PT-2026-40533 · Npm · Protobufjs-Cli

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-42290

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions protobufjs-cli versions prior to 1.2.1 protobufjs-cli versions prior to 2.0.2

Description The pbts command-line tool invokes JSDoc by constructing a shell command string from input file paths and executing it via child process.exec. File paths containing shell metacharacters can be interpreted by the shell rather than being treated as plain arguments. This allows an attacker who can control file names or paths passed to pbts to execute arbitrary shell commands with the privileges of the process running the tool. This issue specifically affects the CLI tooling path and does not impact the runtime APIs used for encoding, decoding, parsing, and loading protobuf messages.

Recommendations Update to version 1.2.1. Update to version 2.0.2. Avoid running pbts on file names or paths controlled by untrusted users. Sanitize or rename input files before invoking pbts. Run the CLI in an isolated environment with minimal privileges.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-42290

GHSA-F84P-CVGM-XGJJ

Affected Products

Protobufjs-Cli

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-42290 · Security Note
• https://osv.dev/vulnerability/GHSA-f84p-cvgm-xgjj · Vendor Advisory
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2 · Note
• https://github.com/protobufjs/protobuf.js · Note
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1 · Note