CRITICAL🇵🇱 Wersja polska

CVE-2026-41242

CVSS 9.4v4.0pub. 2026-04-18upd. 2026-09-02

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability (CWE-94 — code injection) consists of insufficient validation of the "type" field in protobuf definitions compiled by the protobuf.js library. An attacker can place malicious JavaScript code in this field, which is then embedded in dynamically generated decoding functions. When an object is decoded using such a definition, the injected code is executed in the context of the application.

Impact

An attacker with permissions to supply a malicious protobuf definition can execute arbitrary JavaScript code in the context of the application, potentially resulting in process takeover, data leakage, or further system compromise.

Mitigation & patch

Update protobuf.js to version 7.5.5 or 8.0.1, which contain patches eliminating the vulnerability. Patches are available in the project's GitHub repository.

Who is affected

Protobufjs Project protobuf.js in versions earlier than 7.5.5 (7.x branch) and earlier than 8.0.1 (8.x branch)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X