CVE-2026-41242
CRITICALprotobufjs Type Fields - Arbitrary Code Execution
Title source: manualExploitation Summary
EIP tracks 2 public exploits for CVE-2026-41242. PoCs published by Giangdurian, 4chech.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2026-41242, a critical code injection vulnerability in protobuf.js (≤8.0.0/≤7.5.4) where malicious type names in protobuf schemas are improperly handled during dynamic code generation, leading to arbitrary JavaScript execution in Node.js environments.
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Exploits (2)
This repository contains a functional exploit for CVE-2026-41242, a critical code injection vulnerability in protobuf.js (≤8.0.0/≤7.5.4) where malicious type names in protobuf schemas are improperly handled during dynamic code generation, leading to arbitrary JavaScript execution in Node.js environments.
The repository contains only node_modules dependencies (protobufjs libraries) with no actual exploit code or technical details related to CVE-2026-41242. No PoC, scanner, or writeup is present.
References (12)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H