CVE-2026-41242 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-41242 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-41242 is a code injection vulnerability in protobufjs (Project Protobufjs by Protobufjs), a widely used JavaScript library that compiles Protocol Buffer definitions into executable JavaScript functions.

Technical Detail

The flaw exists in how protobufjs processes the "type" fields within protobuf definition files: user-supplied or attacker-controlled input in these fields is not properly sanitized before being compiled into JavaScript, allowing arbitrary code injection into the generated output. An attacker who can supply or influence a protobuf definition file processed by a vulnerable application can achieve remote code execution (RCE) in the context of the application parsing that definition. All versions of protobufjs prior to 8.0.1 and 7.5.5 are affected, and the attack surface includes any application that dynamically loads or processes untrusted protobuf schemas.

Exploitation Status

No known exploit has been confirmed at this time, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The exploit maturity is assessed as no known public exploit or proof-of-concept. However, the critical CVSS score of 9.8 and the straightforward nature of the injection vector mean that exploitation development is plausible in the near term.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been identified in connection with this vulnerability.

What To Do

Organizations using protobufjs should upgrade immediately to version 8.0.1 or 7.5.5, depending on their current release branch. Applications that dynamically load protobuf definitions from external or user-controlled sources carry the highest risk and should be prioritized for patching. As an interim measure, restrict the ability of untrusted sources to supply protobuf definition files to any application using a vulnerable version. Review dependency trees in Node.js projects, as protobufjs is commonly pulled in as a transitive dependency, and audit package-lock.json or yarn.lock files to confirm the resolved version. Monitor application logs for unexpected code execution patterns or anomalous behavior in services that handle protobuf schema parsing.