CVE-2026-42290
HighSummary
In versions prior to 1.2.1 and 2.0.2, the protobufjs-cli invoked JSDoc by building a shell command string from input file paths. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments.
Risk Assessment
This vulnerability could lead to unauthorized command execution on the system, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to version 1.2.1 or 2.0.2 to mitigate this vulnerability and secure the system against potential attacks.
Other vulnerabilities in protobufjs-cli
See all- CVE-2026-44295High
In protobufjs-cli prior to versions 1.2.1 and 2.0.2, there was a vulnerability that allowed the generation of unsafe JavaScript identifiers from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain names could be written into the generated output without sufficient sanitization.
- CVE-2026-54271High
In protobufjs-cli, prior to versions 1.3.2 and 2.5.0, there was an incomplete fix for unsafe name handling in static code generation. Affected versions could emit unsafe JavaScript references when generating static output from crafted JSON descriptor input.
Original NVD description (English source)
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.