CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2026-42290
High (7.8) in protobufjs project protobufjs-cli. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in protobufjs-cli 1.2.1, 2.0.2.
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- protobufjs_project:protobufjs-cli
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-f84p-cvgm-xgjj | npm | protobufjs-cli | <1.2.1 | 1.2.1 |
| GHSA-f84p-cvgm-xgjj | npm | protobufjs-cli | >=2.0.0 <2.0.2 | 2.0.2 |