CVE-2026-41242

Katalog CVE

CVSS 9.8 · Critical EPSS 0,99%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada protobufjs project protobufjs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

Rincian

Terbit di NVD

18 April 2026

Terakhir diubah

9 September 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,99% peluang dieksploitasi; lebih tinggi dari 61,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg exploit · advisory vendor
• https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75 patch
• https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956 patch
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 product · release notes
• https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 product · release notes
• https://access.redhat.com/errata/RHSA-2026:21338
• https://access.redhat.com/errata/RHSA-2026:24977
• https://access.redhat.com/errata/RHSA-2026:26234
• https://access.redhat.com/errata/RHSA-2026:37275
• https://access.redhat.com/errata/RHSA-2026:62260
• https://access.redhat.com/security/cve/CVE-2026-41242
• https://bugzilla.redhat.com/show_bug.cgi?id=2459442
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json