CVE-2026-41242
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability in the protobufjs library allows arbitrary JavaScript code injection via 'type' fields in protobuf definitions. The code executes during object decoding. The issue is fixed in versions 8.0.1 and 7.5.5.
Risk Assessment
An attacker can remotely execute arbitrary JavaScript code in the context of the application using protobufjs, leading to system compromise, data theft, or other malicious actions.
Recommendation
Immediately update the protobufjs library to version 8.0.1 or 7.5.5. Before updating, review if any untrusted protobuf definitions are in use.
Original NVD description (English source)
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.