CVE-2026-42290: protobufjs project protobufjs-cli

csirt@kutim:~/threat-intel/cve/CVE-2026-42290

CVSS 7.8 · High EPSS 0,19%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada protobufjs project protobufjs-cli. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.

Rincian

Terbit di NVD: 13 Mei 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
EPSS (30 hari): 0,19% peluang dieksploitasi; lebih tinggi dari 8,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
protobufjs project	protobufjs-cli	Semua versi sebelum 1.2.1
protobufjs project	protobufjs-cli	Versi 2.0.0 hingga sebelum 2.0.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-f84p-cvgm-xgjj advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.