CVE-2026-41242
CRITICALprotobufjs has an arbitrary code execution issue
Title source: cnaDescription
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Scores
CVSS v3
9.8
EPSS
0.0006
EPSS Percentile
19.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (5)
npm/protobufjs
8.0.0 - 8.0.1npm
protobufjs/protobuf.js
< 7.5.5
protobufjs/protobuf.js
>= 8.0.0-experimental, < 8.0.1
protobufjs_project/protobufjs
8.0.0
protobufjs_project/protobufjs
< 7.5.5
Published
Apr 18, 2026
Tracked Since
Apr 18, 2026