https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T10:31:28.362988+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-42290 CVE-2026-42290 — protobufjs-cli: OS Command Injection 2026-10-07T10:31:28.379781+00:00

Affected: protobufjs protobuf.js

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.