Is CVE-2026-42290 actively exploited?

No active exploitation of CVE-2026-42290 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42290 be exploited remotely?

No. CVE-2026-42290 requires local access to exploit.

What is the CVSS score of CVE-2026-42290?

CVE-2026-42290 has a CVSS score of 7.8 (HIGH).

HOME VULNERABILITIESCVE-2026-42290

HIGH

CVE-2026-42290

CWE-78Published: May 13, 2026· Updated: May 19, 2026

7.8

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:5.8th

Official Description

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process.exec. File paths containing shell metacharacters could therefore be interpreted by the shell instead of being passed to JSDoc as plain arguments. This vulnerability is fixed in 1.2.1 and 2.0.2.

NVD Source

Technical Analysis

CVE-2026-42290 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.