CVE-2026-41242
CVE-2026-41242 · protobufjs has an arbitrary code execution issue
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVSS 9.4 · Crítica · EPSS 0,8% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
protobuf.js
- Versiones
- < 7.5.5: Afectada
- >= 8.0.0-experimental, < 8.0.1: Afectada
Sin corrección publicada
protobufjs npm
- Intervalos de versiones afectados
- SEMVER: ≥ 8.0.0, < 8.0.1
Actualiza a 8.0.1
protobufjs npm
- Intervalos de versiones afectados
- SEMVER: < 7.5.5
Actualiza a 7.5.5
Fuentes originales
- https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
- https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
- https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
- https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1
- https://access.redhat.com/security/cve/CVE-2026-41242
- https://bugzilla.redhat.com/show_bug.cgi?id=2459442
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:62260
- https://nvd.nist.gov/vuln/detail/CVE-2026-41242