Critical severity · published Apr 18, 2026
CVE-2026-41242
protobufjs has an arbitrary code execution issue
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
protobuf.js · protobufjs
< 7.5.5; >= 8.0.0-experimental, < 8.0.1 · source: vendor
PR
Protobufjs · Protobufjs Project
before 7.5.5; 8.0.0 · source: NVD
C4
Cryostat 4 · Red Hat
All versions, or not specified · source: CISA
OP
OpenShift Pipelines · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Build of Podman Desktop · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ceph Storage 9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Developer Hub · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Developer Hub 1.8 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Developer Hub 1.9 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Enterprise Linux AI (RHEL AI) 3 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI (RHOAI) · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 2.25 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41242
Patch
https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
Patch
https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
Product
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
Product
https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
Exploit
https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:21338
More from protobuf.js
8.8
CVE-2026-44293
protobufjs: Code injection through bytes field defaults in generated toObject code
8.7
CVE-2026-44295
protobufjs-cli: Code injection in pbjs static output from crafted schema names
8.1
CVE-2026-44291
protobufjs: Code generation gadget after prototype pollution
7.8
CVE-2026-42290
protobufjs-cli: OS Command Injection
7.5
CVE-2026-59877
protobufjs: Denial of Service via infinite loop in .proto option parsing