{"id":"CVE-2026-41242","aliases":["CLSA-2026-1778114667","CLSA-2026-1784164061","CLSA-2026-1785380788","CLSA-2026-1785468075","CLSA-2026-1785468077","CLSA-2026-1791218903","CLSA-2026-1791293603","CLSA-2026-1792184156","CLSA-2026-1792411164","CLSA-2026-1792490720","EUVD-2026-23678","GHSA-xq3m-2v4x-88gg","ROOT-APP-NPM-CVE-2026-41242","UBUNTU-CVE-2026-41242"],"status":"published","title":"protobufjs has an arbitrary code execution issue","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00774,"percentile":0.56003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2026-04-16T22:34:57Z","modified":"2026-11-05T03:31:26Z","exploits":[{"source":"pocgithub","id":"4chech/CVE-2026-41242","title":"4chech/CVE-2026-41242","date":"2026-04-26","url":"https://github.com/4chech/CVE-2026-41242"},{"source":"pocgithub","id":"Giangdurian/CVE-2026-41242","title":"Giangdurian/CVE-2026-41242","date":"2026-08-07","url":"https://github.com/Giangdurian/CVE-2026-41242"}],"fixes":[{"ecosystem":"npm","package":"protobufjs","fixed_in":["8.0.1","7.5.5","6.11.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"protobufjs","fixed_in":["6.11.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"protobufjs","fixed_in":["6.11.2-aikido.1","7.4.0-aikido.3","7.5.4-aikido.4","6.11.4-aikido.2","6.11.6-aikido.2","7.5.4-aikido.5","7.4.0-aikido.4","7.5.4-aikido.6","7.4.0-aikido.5","7.4.0-aikido.6","6.11.4-aikido.3","6.11.6-aikido.3","6.11.6-aikido.4","6.11.4-aikido.4","6.11.6-aikido.5","7.5.4-aikido.7","7.4.0-aikido.7","7.5.4-aikido.8","6.11.4-aikido.5","6.11.6-aikido.6","7.5.5-aikido.8","7.5.3-aikido.1","7.3.2-aikido.1","7.2.0-aikido.2","7.2.0-aikido.3","7.3.2-aikido.2","7.5.5-aikido.3","8.0.1-aikido.4","7.5.5-aikido.4","8.0.1-aikido.5","8.0.1-aikido.6","7.5.5-aikido.5","8.0.1-aikido.7","7.5.5-aikido.6","8.0.1-aikido.8","7.5.5-aikido.7","8.0.1-aikido.9"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/protobufjs","fixed_in":["7.5.4-root.io.1","7.4.0-root.io.1","7.4.0-root.io.2","7.5.4-root.io.2","7.5.4-root.io.3","6.11.4-root.io.1","6.11.6-root.io.1","6.11.2-root.io.1","7.4.0-root.io.3","7.5.4-root.io.4","6.11.4-root.io.2","6.11.6-root.io.2","7.5.4-root.io.5","7.4.0-root.io.4","7.5.4-root.io.6","7.4.0-root.io.5","7.4.0-root.io.6","6.11.4-root.io.3","6.11.6-root.io.3","6.11.6-root.io.4","6.11.4-root.io.4","6.11.6-root.io.5","7.5.4-root.io.7","7.4.0-root.io.7","7.5.4-root.io.8","6.11.4-root.io.5","6.11.6-root.io.6","7.5.5-root.io.8","7.5.3-root.io.1","7.3.2-root.io.1","7.2.0-root.io.2","7.2.0-root.io.3","7.3.2-root.io.2","7.5.5-root.io.1","8.0.1-root.io.1","8.0.1-root.io.2","7.5.5-root.io.2","8.0.1-root.io.3","7.5.5-root.io.3","8.0.1-root.io.4","7.5.5-root.io.4","8.0.1-root.io.5","8.0.1-root.io.6","7.5.5-root.io.5","8.0.1-root.io.7","7.5.5-root.io.6","8.0.1-root.io.8","7.5.5-root.io.7","8.0.1-root.io.9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.5.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.6-tuxcare.0"},{"fixed":"6.11.6-tuxcare.1"}]}],"versions":["6.11.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.10.2-tuxcare.0"},{"fixed":"6.10.2-tuxcare.1"}]}],"versions":["6.10.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.1-tuxcare.0"},{"fixed":"1.5.1-tuxcare.1"}]}],"versions":["1.5.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.8-tuxcare.0"},{"fixed":"6.8.8-tuxcare.1"}]}],"versions":["6.8.8"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-tuxcare.0"},{"fixed":"5.0.0-tuxcare.2"}]}],"versions":["5.0.0","5.0.0-tuxcare.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.4.0-tuxcare.0"},{"fixed":"7.4.0-tuxcare.1"}]}],"versions":["7.4.0"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0-tuxcare.0"},{"fixed":"8.0.0-tuxcare.1"}]}],"versions":["8.0.0"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.3-tuxcare.0"},{"fixed":"6.11.3-tuxcare.2"}]}],"versions":["6.11.3","6.11.3-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.4-tuxcare.0"},{"fixed":"7.5.4-tuxcare.1"}]}],"versions":["7.5.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.8.2-tuxcare.0"},{"fixed":"3.8.2-tuxcare.1"}]}],"versions":["3.8.2"],"bundled":12},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.5.5"}]}]},{"source":"osv","ecosystem":"npm","package":"protobufjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.11.6"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.2-aikido.1"},{"fixed":"7.4.0-aikido.3"},{"fixed":"7.5.4-aikido.4"},{"fixed":"6.11.4-aikido.2"},{"fixed":"6.11.6-aikido.2"},{"fixed":"7.5.4-aikido.5"},{"fixed":"7.4.0-aikido.4"},{"fixed":"7.5.4-aikido.6"},{"fixed":"7.4.0-aikido.5"},{"fixed":"7.4.0-aikido.6"},{"fixed":"6.11.4-aikido.3"},{"fixed":"6.11.6-aikido.3"},{"fixed":"6.11.6-aikido.4"},{"fixed":"6.11.4-aikido.4"},{"fixed":"6.11.6-aikido.5"},{"fixed":"7.5.4-aikido.7"},{"fixed":"7.4.0-aikido.7"},{"fixed":"7.5.4-aikido.8"},{"fixed":"6.11.4-aikido.5"},{"fixed":"6.11.6-aikido.6"},{"fixed":"7.5.5-aikido.8"},{"fixed":"7.5.3-aikido.1"},{"fixed":"7.3.2-aikido.1"},{"fixed":"7.2.0-aikido.2"},{"fixed":"7.2.0-aikido.3"},{"fixed":"7.3.2-aikido.2"},{"fixed":"7.5.5-aikido.3"},{"fixed":"8.0.1-aikido.4"},{"fixed":"7.5.5-aikido.4"},{"fixed":"8.0.1-aikido.5"},{"fixed":"8.0.1-aikido.6"},{"fixed":"7.5.5-aikido.5"},{"fixed":"8.0.1-aikido.7"},{"fixed":"7.5.5-aikido.6"},{"fixed":"8.0.1-aikido.8"},{"fixed":"7.5.5-aikido.7"},{"fixed":"8.0.1-aikido.9"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/protobufjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.4-root.io.1"},{"fixed":"7.4.0-root.io.1"},{"fixed":"7.4.0-root.io.2"},{"fixed":"7.5.4-root.io.2"},{"fixed":"7.5.4-root.io.3"},{"fixed":"6.11.4-root.io.1"},{"fixed":"6.11.6-root.io.1"},{"fixed":"6.11.2-root.io.1"},{"fixed":"7.4.0-root.io.3"},{"fixed":"7.5.4-root.io.4"},{"fixed":"6.11.4-root.io.2"},{"fixed":"6.11.6-root.io.2"},{"fixed":"7.5.4-root.io.5"},{"fixed":"7.4.0-root.io.4"},{"fixed":"7.5.4-root.io.6"},{"fixed":"7.4.0-root.io.5"},{"fixed":"7.4.0-root.io.6"},{"fixed":"6.11.4-root.io.3"},{"fixed":"6.11.6-root.io.3"},{"fixed":"6.11.6-root.io.4"},{"fixed":"6.11.4-root.io.4"},{"fixed":"6.11.6-root.io.5"},{"fixed":"7.5.4-root.io.7"},{"fixed":"7.4.0-root.io.7"},{"fixed":"7.5.4-root.io.8"},{"fixed":"6.11.4-root.io.5"},{"fixed":"6.11.6-root.io.6"},{"fixed":"7.5.5-root.io.8"},{"fixed":"7.5.3-root.io.1"},{"fixed":"7.3.2-root.io.1"},{"fixed":"7.2.0-root.io.2"},{"fixed":"7.2.0-root.io.3"},{"fixed":"7.3.2-root.io.2"},{"fixed":"7.5.5-root.io.1"},{"fixed":"8.0.1-root.io.1"},{"fixed":"8.0.1-root.io.2"},{"fixed":"7.5.5-root.io.2"},{"fixed":"8.0.1-root.io.3"},{"fixed":"7.5.5-root.io.3"},{"fixed":"8.0.1-root.io.4"},{"fixed":"7.5.5-root.io.4"},{"fixed":"8.0.1-root.io.5"},{"fixed":"8.0.1-root.io.6"},{"fixed":"7.5.5-root.io.5"},{"fixed":"8.0.1-root.io.7"},{"fixed":"7.5.5-root.io.6"},{"fixed":"8.0.1-root.io.8"},{"fixed":"7.5.5-root.io.7"},{"fixed":"8.0.1-root.io.9"}]}]}],"products":[{"vendor":"protobufjs","product":"protobuf.js"},{"vendor":"protobufjs_project","product":"protobufjs"},{"vendor":"red hat","product":"cryostat 4"},{"vendor":"red hat","product":"openshift pipelines"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of podman desktop"},{"vendor":"red hat","product":"red hat ceph storage 9"},{"vendor":"red hat","product":"red hat developer hub"},{"vendor":"red hat","product":"red hat developer hub 1.8"},{"vendor":"red hat","product":"red hat developer hub 1.9"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 2.25"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift data foundation 4"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.30"},{"vendor":"red hat","product":"self-service automation portal 2"}],"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21338","tags":["x_refsource_MISC","vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:24977","tags":["x_refsource_MISC","vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","tags":["x_refsource_MISC","vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37275","tags":["x_refsource_MISC","vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["x_refsource_MISC","vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41242","tags":["x_refsource_MISC","vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459442","tags":["x_refsource_MISC","issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/protobufjs/protobuf.js/tree/v6.11.6","tags":["x_refsource_MISC","web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json","tags":["x_refsource_MISC","x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41242","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xq3m-2v4x-88gg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41242.json","tags":["advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-41242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41242","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-41242","title":"protobufjs has an arbitrary code execution issue","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.","status":"published","published":"2026-04-18T16:18:10.652Z","modified":"2026-11-03T16:07:22.43Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94","CWE-94"],"updated_at":"2026-11-03T17:29:02.641245Z"}],"euvd":[{"id":"EUVD-2026-23678","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.","status":"published","published":"2026-04-18T16:18:10Z","modified":"2026-11-03T16:07:22Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-03T17:18:21.496138Z"}],"ghsa":[{"id":"GHSA-xq3m-2v4x-88gg","title":"protobufjs has an arbitrary code execution issue","description":"## Summary\n\nprotobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach runtime code generation without sufficient validation.\n\n## Impact\n\nAn attacker who can provide a malicious protobuf definition or JSON descriptor to an application may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires control over the protobuf schema or descriptor being loaded. Applications that only decode messages using trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf definition or JSON descriptor.\n- The application must load that definition through protobufjs reflection APIs such as descriptor loading.\n- The affected generated-code path must be reached, for example by performing an operation on the loaded type.\n\n## Workarounds\n\nDo not load protobuf definitions or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict them before loading and run schema processing in an isolated environment.","status":"published","published":"2026-04-16T22:34:57Z","modified":"2026-11-04T17:14:43Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-04T17:24:03.876303Z"}],"nvd":[{"id":"CVE-2026-41242","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.","status":"published","published":"2026-04-18T17:16:13.983Z","modified":"2026-11-03T17:18:13.75Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-03T20:18:12.819464Z"}],"osv":[{"id":"CVE-2026-41242","title":"protobufjs has an arbitrary code execution issue","description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.","status":"published","published":"2026-04-18T16:18:10.652Z","modified":"2026-11-05T03:31:26.986080071Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-05T07:12:28.867005Z"},{"id":"GHSA-xq3m-2v4x-88gg","title":"protobufjs has an arbitrary code execution issue","description":"## Summary\n\nprotobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach runtime code generation without sufficient validation.\n\n## Impact\n\nAn attacker who can provide a malicious protobuf definition or JSON descriptor to an application may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires control over the protobuf schema or descriptor being loaded. Applications that only decode messages using trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf definition or JSON descriptor.\n- The application must load that definition through protobufjs reflection APIs such as descriptor loading.\n- The affected generated-code path must be reached, for example by performing an operation on the loaded type.\n\n## Workarounds\n\nDo not load protobuf definitions or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict them before loading and run schema processing in an isolated environment.","status":"published","published":"2026-04-16T22:34:57Z","modified":"2026-11-04T17:28:36.820467286Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-04T17:42:00.555354Z"},{"id":"ROOT-APP-NPM-CVE-2026-41242","title":"CVE-2026-41242 in protobufjs - Patched by Root","description":"Root has patched CVE-2026-41242 in the protobufjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-29T11:44:16Z","modified":"2026-09-29T12:15:02.914986725Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"CLSA-2026-1778114667","title":"TuxCare security update for protobufjs (1 CVE)","description":"TuxCare rebuilt protobufjs to address 1 CVE. Fixed in 6.11.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-15T09:45:30.868527585Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1784164061","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 6.10.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-30T19:45:57.267311183Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1785380788","title":"TuxCare security update for protobufjs (3 CVEs)","description":"TuxCare rebuilt protobufjs to address 3 CVEs. Fixed in 1.5.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-23T19:28:12.787611364Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468075","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 6.8.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.137107213Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468077","title":"TuxCare security update for protobufjs (7 CVEs)","description":"TuxCare rebuilt protobufjs to address 7 CVEs. Fixed in 5.0.0-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.183593535Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791218903","title":"TuxCare security update for protobufjs (11 CVEs)","description":"TuxCare rebuilt protobufjs to address 11 CVEs. Fixed in 7.4.0-tuxcare.1.","status":"published","published":"2026-10-05T16:48:23Z","modified":"2026-10-15T09:47:35.511996505Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293603","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 8.0.0-tuxcare.1.","status":"published","published":"2026-10-06T13:33:23Z","modified":"2026-10-15T09:47:58.261804525Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792184156","title":"TuxCare security update for protobufjs (8 CVEs)","description":"TuxCare rebuilt protobufjs to address 8 CVEs. Fixed in 6.11.3-tuxcare.2.","status":"published","published":"2026-10-16T20:55:56Z","modified":"2026-10-17T01:30:06.508288094Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792411164","title":"TuxCare security update for protobufjs (4 CVEs)","description":"TuxCare rebuilt protobufjs to address 4 CVEs. Fixed in 7.5.4-tuxcare.1.","status":"published","published":"2026-10-19T11:59:24Z","modified":"2026-10-19T13:30:05.667164716Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792490720","title":"TuxCare security update for protobufjs (12 CVEs)","description":"TuxCare rebuilt protobufjs to address 12 CVEs. Fixed in 3.8.2-tuxcare.1.","status":"published","published":"2026-10-20T10:05:18Z","modified":"2026-10-20T13:45:16.914475482Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"UBUNTU-CVE-2026-41242","description":"(protobufjs compiles protobuf definitions into JavaScript (JS) function ...)","status":"withdrawn","published":"2026-04-20T00:00:00Z","modified":"2026-04-27T18:57:28.433949Z","updated_at":"2026-11-02T16:56:16.686388Z"}]}}