CVE-2026-41242

[CVE catalog]

Severity

Critical · CVSS 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Apr 18, 2026, 4:18:10 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.77% · Oct 25, 2026

A flaw was found in protobufjs, a JavaScript (JS) library used for compiling protobuf definitions. A remote attacker with low privileges can exploit this vulnerability by injecting arbitrary code into the "type" fields of protobuf definitions. This malicious code will then execute during the object decoding process, leading to arbitrary code execution and potentially full system compromise. protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields This Important impact remote code execution vulnerability in protobufjs allows attackers to inject arbitrary code into the 'type' fields of protobuf definitions, which executes during object decoding. Red Hat products that process untrusted protobuf definitions using the affected library versions are at risk. Red Hat has assessed this at IMPORTANT (not Critical) as exploitation requires low privileges. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.