CVE-2026-42290: protobuf.js is Vulnerable to OS Command Injection in the CLI

May 12, 2026 (updated May 14, 2026)

pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments.

References

github.com/advisories/GHSA-f84p-cvgm-xgjj
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v1.2.1
github.com/protobufjs/protobuf.js/releases/tag/protobufjs-cli-v2.0.2
github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj
nvd.nist.gov/vuln/detail/CVE-2026-42290

Code Behaviors & Features

Detect and mitigate CVE-2026-42290 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →