GHSA-f84p-cvgm-xgjj
High · 7.8CVSS
7.8
EPSS
—
Published
May 12, 2026
CISA due date
—
The record
protobuf.js is Vulnerable to OS Command Injection in the CLI
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | protobufjs-cli | 0 | 1.2.1 |
| npm | protobufjs-cli | 2.0.0 | 2.0.2 |
Related vulnerabilities
- CVE-2026-42290 protobufjs-cli is the command line add-on for protobuf.js. Same vulnerability
- CVE-2026-54271 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- CVE-2026-54269 protobufjs compiles protobuf definitions into JavaScript (JS) functions. Also affects protobufjs-cli
- GHSA-pr59-h9ph-3fr8 protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor names Also affects protobufjs-cli
- GHSA-f38q-mgvj-vph7 protobufjs : Schema-derived names can shadow runtime-significant properties Also affects protobufjs-cli
- CVE-2026-44295 protobufjs-cli is the command line add-on for protobuf.js. Also affects protobufjs-cli
- GHSA-6r35-46g8-jcw9 protobuf.js: Code injection in pbjs static output from crafted schema names Also affects protobufjs-cli
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78