CVE-2026-41242: protobufjs_project protobufjs Code Injection
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2026-41242CGA-5pwm-hjq6-c83mCGA-5vrf-pj82-c35qCGA-6qw9-8hr4-r8qqCGA-75cm-wx3x-xr2fCGA-75ww-3ph5-mp69CGA-78rc-wxg3-pq29CGA-7wxm-fh69-83gcCGA-f88p-wmm6-fj4gCGA-fjx7-jv76-vcrhCGA-g5vp-c4jh-wfwfCGA-qrf5-g49p-vvmwCGA-vm9x-4568-pm2mCGA-wjr9-95mv-v8g4CGA-xm96-r337-89jpCGA-xpx3-3c47-cc3xCGA-xqc5-86w4-rhg8CGA-xqx2-xrqw-j88rGHSA-xq3m-2v4x-88ggCGA-2j3h-pj7x-jhjcCGA-3m5j-g5qx-5484CGA-3r9v-8hr8-9rqfCGA-3rw3-wgg4-7grfCGA-4mqr-7w77-jmmcCGA-4vq3-r6qv-hpf9CGA-4xw2-6x7p-v6vgCGA-536c-pg2q-6fxqCGA-53vx-j8v7-rccqCGA-5gw6-72qh-j42gCGA-5r3x-mf4g-fjwrCGA-5vfr-5w5x-rhxjCGA-5vwg-x6h7-ppcrCGA-654g-53m6-jwhrCGA-6642-3xpj-v99jCGA-6fvr-2ccr-4cp6CGA-6mrj-r3rm-2g2fCGA-76g9-r6v4-6jm6CGA-79fm-w7ff-ffpfCGA-7pwr-pq4m-2jv4CGA-7qgc-vxjc-px7rCGA-7v32-6h8j-46h4CGA-7vcw-mc3c-xx8hCGA-7w74-99xg-929mCGA-86p8-j52w-pjp2CGA-87jh-32c7-8wjhCGA-8wfr-j46w-rm4pCGA-9463-6rp7-4pmfCGA-96cg-pw58-cxc8CGA-9q8h-4hjf-w5pgCGA-chgq-c2j3-25r6CGA-cjwq-4wqc-mcq5CGA-f4c7-6m66-x7ffCGA-f53r-vwm7-5prxCGA-f9x5-ffrf-h32rCGA-ff8j-275c-r2jcCGA-fr7x-9cgc-mx2qCGA-fw6q-qcv8-5q8jCGA-ggxq-2pqx-mr6xCGA-gvw7-prfg-63crCGA-h3cv-wr74-x78jCGA-h8mp-3v6v-27p6CGA-hf52-rf9h-v3jrCGA-hw3x-67p3-35mqCGA-j2p4-p346-8jmwCGA-j2vg-9xwc-37rqCGA-j475-8q44-x7pxCGA-j6gf-h4gw-5wqmCGA-jw5p-2qjw-78cjCGA-m3c4-5w8r-gv6gCGA-m8x9-2qxj-r5v3CGA-m97x-j894-745jCGA-mhmq-6369-fpv7CGA-mwpf-92wm-r94jCGA-pp4f-j345-q8r4CGA-ppg9-5ff9-4pq4CGA-pr8q-x3cx-9894CGA-pwh5-9hw5-hc2cCGA-q53r-4jw7-q48qCGA-q67j-w5m8-6x75CGA-q694-5hmh-6x7pCGA-q9p2-7422-8xm3CGA-q9x5-6w8q-6x5rCGA-qg33-2gcr-jqr6CGA-qg4p-jm8v-296vCGA-qv7j-3m7x-wx9xCGA-qw73-px4c-xmw2CGA-r74q-vg69-x3cfCGA-rc32-873x-6hr2CGA-rhp8-j5j8-3rg9CGA-rqwh-qhjf-22q4CGA-v3j5-48m6-fj58CGA-v49x-p2cx-6j5hCGA-v5px-6qv8-x7wvCGA-vf8p-rj6v-9x23CGA-w34g-mm48-j5hqCGA-w3fp-332f-w5r6CGA-wjx6-m6fq-h98fCGA-wxqx-4fmg-5x3vCGA-x253-w373-52gvCGA-x63m-6rww-c5mjCGA-xp52-qf3f-gg27
Published 18-04-2026Last modified 09-09-2026
Vulnerability summary
CVE-2026-41242 is a critical (CVSS 9.8) Code Injection vulnerability in protobufjs_project protobufjs. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.99%
0%100%
Low · +0.22 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 18-04-2026PublishedVulnerability first disclosed.
- 09-09-2026Last modifiedVulnerability information updated.
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVSS metrics
8 scores · 5 sources · 2 versionsCritical 9.4Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · NpmEcosystem advisory · calculated9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- OSV · ChainguardEcosystem advisory · calculated9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- NVDNIST9.4CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources3 sources · 8.8–9.8
- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
+0.22 pp
From 0.77% on 19-09-2026
19-09-202619-10-2026
EPSS score0.99%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundProtobuf.Js
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard39 products
- gemini-cli< 0.44.0-r0
- jitsucom-jitsu-console< 2.11.0-r22
- kibana-8.17< 8.17.10-r18
- kibana-8.17-bitnami< 8.17.10-r18
- kibana-8.17-iamguarded< 8.17.10-r18
Wolfi7 products
- jitsucom-jitsu-console< 2.11.0-r22
- kubeflow-centraldashboard< 1.10.0-r20
- langfuse-3< 3.164.0-r6
- langfuse-3-worker< 3.164.0-r6
- pulumi-language-nodejs< 3.229.0-r5
Npm1 product
- protobufjs≥ 8.0.0, < 8.0.1 | < 7.5.5
Protobufjs1 product
- protobuf.js< 7.5.5 | ≥ 8.0.0-experimental, < 8.0.1
Protobufjs_project1 product
- protobufjs< 7.5.5 | 8.0.0
Ubuntu1 product
- protobufAll versions (No fix recorded)
6 vendors · 50 products
References
18 links- github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88ggX Refsource CONFIRMAdvisoryWEBExploitVendor Advisory
- github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75X Refsource MISCFIXWEBPatch
- github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956X Refsource MISCFIXWEBPatch
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5X Refsource MISCWEBProductRelease Notes
- github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1X Refsource MISCWEBProductRelease Notes
