CVE-2026-41242
protobufjs has an arbitrary code execution issue
CRITICAL 9.4EPSS 1.0%
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
- Affected
- protobufjs · protobuf.js
- CVSS v4.0 GITHUB
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v4.0 GitHub
- 9.4 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 CNA
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.99% chance of exploitation in the next 30 days, 62nd percentile
- Published
- 2026-04-18
- Updated
- 2026-09-09
Proof-of-concept exploits (2)
- 4chech/CVE-2026-412420★ · 2026-04-26
- Giangdurian/CVE-2026-412420★ · 2026-08-07
Security advisories
- protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- advisories/GHSA-xq3m-2v4x-88gg
- protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75