protobufjs-cli: OS Command Injection (protobufjs protobuf.js)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.13 % · percentile 3 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Analyzed
Description
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-f84p-cvgm-xgjj — protobuf.js is Vulnerable to OS Command Injection in the CLI
European references
- ENISA EUVD · EUVD-2026-29996
- GCVE · GCVE-0-2026-42290
Affected configurations (NVD CPE)
cpe:2.3:a:protobufjs_project:protobufjs-cli:*:*:*:*:*:node.js:*:*< 1.2.1cpe:2.3:a:protobufjs_project:protobufjs-cli:*:*:*:*:*:node.js:*:*≥ 2.0.0 < 2.0.2
Affected products
| Product | Versions |
|---|---|
| protobufjs · protobuf.js | affected >= 2.0.0, < 2.0.2 ; affected < 1.2.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |