Is CVE-2026-42290 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42290 being exploited in the wild.

How severe is CVE-2026-42290?

High severity, with a CVSS score of 7.8, published 13 May 2026.

Which products and versions are affected?

protobufjs-cli (npm) SEMVER:introduced=0,fixed=1.2.1.

Is there a fix for CVE-2026-42290?

Yes. protobufjs-cli (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42290 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-42290?

Check whether you run protobufjs-cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42290: protobufjs-cli OS command injection in pbts utility

CVE-2026-42290 · Severity: high · CVSS 7.8 · Published 2026-05-13

protobufjs-cli is a command-line tool used to work with Protocol Buffers in JavaScript environments. A security flaw allows an attacker to execute unauthorized commands on a system if they can trick a user or automated process into running the tool on a specially named file. This could lead to a full system compromise, data theft, or service disruption depending on the permissions of the user running the tool.

Technologies: protobufjs-cli (npm). Vendors: npm.

Quick answers

Is CVE-2026-42290 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42290 being exploited in the wild.
How severe is CVE-2026-42290?: High severity, with a CVSS score of 7.8, published 13 May 2026.
Which products and versions are affected?: protobufjs-cli (npm) SEMVER:introduced=0,fixed=1.2.1.
Is there a fix for CVE-2026-42290?: Yes. protobufjs-cli (npm): upgrade to 1.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42290 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-42290?: Check whether you run protobufjs-cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

protobufjs-cli (npm): upgrade to 1.2.1 or later
```
npm install protobufjs-cli@1.2.1
```

Technical details

The vulnerability is an OS command injection (CWE-78) within the 'pbts' utility of protobufjs-cli. The root cause is the use of 'child_process.exec' to invoke JSDoc, where the command string is constructed by concatenating input file paths without proper neutralization of shell metacharacters. An attacker who can influence the file names or paths passed to 'pbts' can inject arbitrary shell commands. Exploitation requires the victim to run the tool against attacker-controlled file paths (Local attack vector with User Interaction). The issue is resolved in versions 1.2.1 and 2.0.2 by properly handling arguments.

Affected products

protobufjs protobufjs-cli <=1.2.0, >=2.0.0, <=2.0.1

Identifiers

CVE-2026-42290
GHSA-f84p-cvgm-xgjj

Timeline

2026-05-12: advisory: GitHub Security Advisory published
2026-05-13: disclosed: NVD publication date

References

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.