The protobufjs-cli vulnerability allows an attacker who can control the file paths passed to the pbts command to inject shell metacharacters into the command string that is executed via child_process.exec. This injection enables arbitrary shell command execution, effectively Remote Code Execution on the system where the CLI is run. The weakness is a classic instance of CWE-78, OS command injection.

The flaw exists in the protobuf.js command line add‑on for all versions prior to 1.2.1 in the 1.x series and prior to 2.0.2 in the 2.x series. Users running any of those pre‑patched releases are impacted.

The CVSS score of 7.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying no confirmed exploitation yet. Because the problem is triggered by executing the CLI locally with untrusted file names, the likely attack vector is local; an attacker who can run pbts and influence the input file paths can easily inject shell commands, resulting in full control over the executing environment.