Junglewise Threat Intelligence

CVE-2026-41242: protobufjs code injection in protobuf definitions

CVE-2026-41242 · Severity: critical · CVSS 9.8 · Published 2026-04-18

Vendors: Protobufjs.

Executive brief

protobufjs is a popular library used to handle data serialization in JavaScript applications. A vulnerability exists where the library fails to properly sanitize data types when loading configuration files. If an application allows users to provide their own data definitions, an attacker could inject malicious code that executes on the server or in the user's browser, potentially leading to a full system takeover.

Technical details

A code injection vulnerability exists in protobufjs due to improper control of generation of code (CWE-94). The library compiles protobuf definitions into JavaScript functions; however, it fails to validate the "type" fields within these definitions or JSON descriptors. An attacker who can influence the protobuf schema or descriptor loaded via reflection APIs can inject arbitrary JavaScript code. This code is subsequently executed during object decoding or other operations on the loaded type. The issue is resolved in versions 7.5.5 and 8.0.1 by implementing a regex filter to ensure type names only contain alphanumeric characters.

Affected products

  • protobufjs protobufjs < 7.5.5, 8.0.0

Timeline

  • 2026-03-11: patched: Version 8.0.1 released
  • 2026-04-16: advisory: GitHub Security Advisory published
  • 2026-04-17: patched: Version 7.5.5 released
  • 2026-04-18: disclosed: CVE published to NVD

References