CVE-2026-42290

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.

• CWE-78

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjjVendor Advisory

Published

May 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42285GoBGP is an open source Border Gateway Protocol (BGP) implem…7.5
• CVE-2026-42286Emlog is an open source website building system. Prior to ve…8.4
• CVE-2026-42287Emlog is an open source website building system. Prior to ve…10
• CVE-2026-42288ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-42289ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-4229A flaw has been found in vanna-ai vanna up to 2.0.2. This im…7.3
• CVE-2026-42291SysReptor is a fully customizable pentest reporting platform…6.8
• CVE-2026-42294Argo Workflows is an open source container-native workflow e…7.5
• CVE-2026-42295Argo Workflows is an open source container-native workflow e…4.9
• CVE-2026-42296Argo Workflows is an open source container-native workflow e…8.1
• CVE-2026-42297Argo Workflows is an open source container-native workflow e…8.3
• CVE-2026-42298Postiz is an AI social media scheduling tool. Prior to commi…9.8