Executive brief
protobufjs-cli is a command-line tool used to work with Protocol Buffers in JavaScript environments. A security flaw allows an attacker to execute unauthorized commands on a system if they can trick a user or automated process into running the tool on a specially named file. This could lead to a full system compromise, data theft, or service disruption depending on the permissions of the user running the tool.
Technical details
The vulnerability is an OS command injection (CWE-78) within the 'pbts' utility of protobufjs-cli. The root cause is the use of 'child_process.exec' to invoke JSDoc, where the command string is constructed by concatenating input file paths without proper neutralization of shell metacharacters. An attacker who can influence the file names or paths passed to 'pbts' can inject arbitrary shell commands. Exploitation requires the victim to run the tool against attacker-controlled file paths (Local attack vector with User Interaction). The issue is resolved in versions 1.2.1 and 2.0.2 by properly handling arguments.
Affected products
- protobufjs protobufjs-cli <=1.2.0, >=2.0.0, <=2.0.1
Timeline
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date