PT-2026-33607 · Npm · Protobufjs

Published 2026-04-16 · Updated 2026-05-22 · CVE-2026-41242

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions protobufjs versions prior to 8.0.1 protobufjs versions prior to 7.5.5

Description This issue involves improper code generation when compiling protobuf definitions into JavaScript functions. Attackers can inject arbitrary code into the 'type' fields of protobuf definitions, which leads to remote code execution during the object decoding process.

Recommendations Update to version 8.0.1. Update to version 7.5.5. Avoid decoding untrusted protobuf definitions.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-05548

CVE-2026-41242

Affected Products

Protobufjs

References · 22

• https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75 · Patch
• https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956 · Patch
• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41242 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-41242 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41242 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05548 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41242 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41242 · Vendor Advisory
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 · Note
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 · Note
• https://twitter.com/0dayPublishing/status/2045542808614830440 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045555111078838489 · Twitter Post
• https://twitter.com/cybrsecpath/status/2047861126994809262 · Twitter Post
• https://twitter.com/UpwindMDR/status/2045842649794465934 · Twitter Post