VULNERABILITY INTELLIGENCE

CVE-2026-41242

CVSS score9.8 CRITICAL
EPSS probability0.77%
CISA KEVNot currently listed
Published2026-04-18
Last modified2026-09-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Weakness classification

  • security-advisories@github.com: CWE-94
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-94

Primary references