PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42290 protobufjs CVE debrief

A command injection vulnerability exists in protobufjs-cli, the command-line add-on for protobuf.js. The `pbts` tool constructs shell command strings from input file paths and executes them via `child_process.exec` without proper sanitization. File paths containing shell metacharacters can be interpreted by the shell rather than passed as literal arguments to JSDoc, enabling arbitrary code execution. This vulnerability affects versions prior to 1.2.1 in the 1.x branch and versions 2.0.0 through 2.0.1 in the 2.x branch. The issue is resolved in versions 1.2.1 and 2.0.2.

Vendor
protobufjs
Product
protobuf.js
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-05-19
Advisory published
2026-05-13
Advisory updated
2026-05-19

Who should care

Development teams using protobufjs-cli for TypeScript definition generation, particularly in automated build pipelines, CI/CD systems, or developer tooling workflows where file paths may originate from external or untrusted sources.

Technical summary

The protobufjs-cli package provides the `pbts` command-line tool for generating TypeScript definitions from Protocol Buffer files. The vulnerability exists because `pbts` builds shell command strings by concatenating user-supplied file paths and executes them through `child_process.exec`. When file paths contain shell metacharacters such as backticks, dollar signs, semicolons, or pipes, the shell interprets these characters rather than treating them as literal path components. This allows injection of arbitrary shell commands. The attack requires local access with user interaction (providing a malicious file path), but can result in complete confidentiality, integrity, and availability compromise of the local system. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a base score of 7.8 (HIGH).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade protobufjs-cli to version 1.2.1 or 2.0.2 or later
  • Audit build pipelines and CI/CD configurations for usage of pbts with untrusted file paths
  • Implement input validation to sanitize file paths before passing to pbts
  • Consider using child_process.spawn with argument arrays instead of exec for subprocess invocation
  • Review dependency lockfiles for transitive protobufjs-cli usage

Evidence notes

The vulnerability stems from unsafe shell command construction in the `pbts` CLI tool. The NVD record confirms affected version ranges and CVSS 3.1 scoring. The GitHub Security Advisory provides vendor confirmation and fix versions. CWE-78 (OS Command Injection) is the primary weakness classification.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42290 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42290

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42290 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42290

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.