CVE-2026-41242
protobufjs has an arbitrary code execution issue
- State
- Published
- Severity
- 9.4 Critical
- Published
- Apr 18, 2026
- Updated
- Sep 9, 2026
- Reserved
- Apr 18, 2026
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.4 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | GitHub_M |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | redhat-SADP |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
protobuf.jsprotobufjs |
|
References
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- https://access.redhat.com/security/cve/CVE-2026-41242vdb-entry
- RHBZ#2459442issue-tracking
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
- https://access.redhat.com/errata/RHSA-2026:21338vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:26234vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:24977vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:37275vendor-advisory
- https://access.redhat.com/errata/RHSA-2026:62260vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.