CVE-2026-41242 | BDVDB-2026-327653 Detail
protobufjsprotobuf.js
Description#
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References#
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/security/cve/CVE-2026-41242
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- https://github.com/protobufjs/protobuf.js/tree/v6.11.6
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.