7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42290

CVE-2026-42290: protobufjs-cli: OS Command Injection

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42290

CVE-2026-42290:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
protobufjs-cli	npm	<= 1.2.0	1.2.1
protobufjs-cli	npm	>= 2.0.0, <= 2.0.1	2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the pbts command-line tool of protobuf.js. Specifically, the main function in cli/pbts.js was using child_process.exec to call jsdoc. The command passed to exec was constructed by concatenating strings, including file paths provided as input to pbts. An attacker could provide a specially crafted file path containing shell metacharacters, which would then be executed by the shell, leading to OS command injection. The patch replaces the insecure child_process.exec call with child_process.spawn, which takes arguments as an array, thus preventing the shell from interpreting any special characters in the file paths. The vulnerable function is main in cli/pbts.js, as it is the function that contains the vulnerable child_process.exec call.

Vulnerable functions

main

cli/pbts.js

The `main` function in `cli/pbts.js` constructs a shell command by concatenating user-provided file paths and executes it using `child_process.exec`. This allows an attacker to inject arbitrary shell commands by providing a file path with shell metacharacters.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.