Critical
protobufjs has an arbitrary code execution issue
Type: advisorySources: OSV
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41242
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 16:25 UTC · Revision 1
Source evidence
protobufjs has an arbitrary code execution issue
core-osv · Original sourcePublished 18 Apr 2026, 16:18 UTC
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
osv:CVE-2026-41242
Complete source record
{
"id": "6a863c713bc3798b87fdaaf84cf5641023fb11195e13d4ad993593351937a302",
"url": "https://osv.dev/vulnerability/CVE-2026-41242",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "protobufjs has an arbitrary code execution issue",
"summary": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.",
"evidence": "osv:CVE-2026-41242",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-41242",
"aliases": [
"CVE-2026-41242",
"GHSA-xq3m-2v4x-88gg"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/protobufjs/protobuf.js",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b7bdfaf91d7bf279326f2d043b633da0a2dbfe47"
},
{
"introduced": "933e8750dcd000c16a621a7344a4beaa034c4019"
},
{
"fixed": "535df444ac060243722ac5d672db205e5c531d75"
},
{
"fixed": "ff7b2afef8754837cc6dc64c864cd111ab477956"
},
{
"fixed": "6559b3df799abe061a8e3f0313972d60ad9e24a4"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "7.5.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:protobufjs_project:protobufjs:8.0.0:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"last_affected": "8.0.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "535df444ac060243722ac5d672db205e5c531d75"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ff7b2afef8754837cc6dc64c864cd111ab477956"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b7bdfaf91d7bf279326f2d043b633da0a2dbfe47"
}
],
"source": "REFERENCES_TAG",
"original_tag": "protobufjs-v7.5.5"
},
{
"range": [
{
"fixed": "6559b3df799abe061a8e3f0313972d60ad9e24a4"
}
],
"source": "REFERENCES_TAG",
"original_tag": "protobufjs-v8.0.1"
}
]
}
}
],
"versions": [
"8.0.0",
"protobufjs-v7.5.4",
"protobufjs-v8.0.0",
"protobufjs-cli-v2.0.0",
"protobufjs-v7.5.3",
"protobufjs-v7.5.2",
"protobufjs-v7.5.1",
"protobufjs-v7.5.0",
"protobufjs-cli-v1.2.0",
"protobufjs-v7.4.0",
"protobufjs-cli-v1.1.4",
"protobufjs-v7.3.3",
"protobufjs-cli-v1.1.3",
"protobufjs-v7.3.2",
"protobufjs-v7.3.1",
"protobufjs-v7.3.0",
"protobufjs-v7.2.6",
"protobufjs-v7.2.5",
"protobufjs-cli-v1.1.2",
"protobufjs-v7.2.4",
"protobufjs-v7.2.3",
"protobufjs-v7.2.2",
"protobufjs-v7.2.1",
"protobufjs-cli-v1.1.1",
"protobufjs-v7.2.0",
"protobufjs-cli-v1.1.0",
"protobufjs-v7.1.2",
"protobufjs-v7.1.1",
"protobufjs-cli-v1.0.2",
"protobufjs-v7.1.0",
"protobufjs-cli-v1.0.1",
"protobufjs-v7.0.0",
"protobufjs-cli-v1.0.0",
"v6.10.2",
"v6.10.1",
"v6.10.1-beta.0",
"v6.10.0",
"v6.10.0-beta.2",
"v6.10.0-beta.1",
"v6.10.0-beta.0",
"v6.9.0",
"v6.9.0-beta.0",
"6.8.8",
"6.8.7",
"6.8.6",
"6.8.5",
"6.8.4",
"6.8.3",
"6.8.2",
"6.8.1",
"6.8.0",
"6.7.3",
"6.7.2",
"6.7.1",
"6.7.0",
"6.6.5",
"6.6.4",
"6.6.3",
"6.6.2",
"6.6.1",
"6.6.0",
"6.5.3",
"6.5.2",
"6.5.1",
"6.5.0",
"6.4.6",
"6.4.5",
"6.4.4",
"6.4.3",
"6.4.2",
"6.4.1",
"6.4.0",
"6.3.1",
"6.3.0",
"6.2.1",
"6.2.0",
"6.1.1",
"6.1.0",
"6.0.2",
"6.0.1",
"6.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41242.json"
}
}
],
"modified": "2026-10-28T02:30:37.441737893Z",
"provider": "osv",
"references": [
"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5",
"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1",
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json",
"https://access.redhat.com/errata/RHSA-2026:21338",
"https://access.redhat.com/errata/RHSA-2026:24977",
"https://access.redhat.com/errata/RHSA-2026:26234",
"https://access.redhat.com/errata/RHSA-2026:37275",
"https://access.redhat.com/errata/RHSA-2026:62260",
"https://access.redhat.com/security/cve/CVE-2026-41242",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41242.json",
"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"https://nvd.nist.gov/vuln/detail/CVE-2026-41242",
"https://bugzilla.redhat.com/show_bug.cgi?id=2459442",
"https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75",
"https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41242.json"
}
},
"related_cves": [
{
"value": "CVE-2026-41242",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 504647,
"published_at": "2026-04-18T16:18:10.652+00:00"
}