CVE Feed

    Dashboard / CVE / CVE-2026-41242

    CVE-2026-41242

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

    Published:Apr 18, 2026
    Last Modified:Sep 2, 2026
    EPS:Apr 18, 2026
    EPSS Score:0.00774
    CVSS Score:9.8

    Affected Products

    Vendor
    Protobuf
    Product
    Protobuf
    Vendor
    Protobufjs Project
    Product
    Protobufjs

    Exploits

    https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gghttps://github.com/4chech/CVE-2026-41242https://github.com/Giangdurian/CVE-2026-41242

    Related CVEs

    CVE-2026-59876 (CVSS 4.8) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufj…
    CVE-2026-59877 (CVSS 5.3) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs …
    CVE-2026-54269 (CVSS 5.3) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs …
    CVE-2026-48712 (CVSS 7.5) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs …
    CVE-2026-54270 (CVSS 5.3) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs prese…
    CVE-2026-44295 (CVSS 8.7) — protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbjs static code generati…
    CVE-2026-42290 (CVSS 7.8) — protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by bui…
    CVE-2026-45740 (CVSS 5.3) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.8 and 8.2.0, protobufjs …
    CVE-2026-44294 (CVSS 5.3) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs …
    CVE-2026-44293 (CVSS 7.7) — protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs …

    References

    https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
    https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
    https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
    https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
    https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
    https://access.redhat.com/errata/RHSA-2026:21338
    https://access.redhat.com/errata/RHSA-2026:24977
    https://access.redhat.com/errata/RHSA-2026:26234
    https://access.redhat.com/errata/RHSA-2026:37275
    https://access.redhat.com/errata/RHSA-2026:62260
    https://access.redhat.com/security/cve/CVE-2026-41242
    https://bugzilla.redhat.com/show_bug.cgi?id=2459442
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High