{"id":"CVE-2026-41242","kind":"vulnerability","aliases":["CVE-2026-41242","GHSA-xq3m-2v4x-88gg"],"related":[],"title":"protobufjs has an arbitrary code execution issue","description":"## Summary\n\nprotobufjs could execute generated JavaScript code derived from protobuf schema metadata. When loading a crafted JSON descriptor, schema-controlled type names and type references could reach runtime code generation without sufficient validation.\n\n## Impact\n\nAn attacker who can provide a malicious protobuf definition or JSON descriptor to an application may be able to execute arbitrary JavaScript in the context of the process using protobufjs.\n\nThis requires control over the protobuf schema or descriptor being loaded. Applications that only decode messages using trusted, application-defined schemas are not directly affected by this issue.\n\n## Preconditions\n\n- The application must allow an attacker to control or influence a protobuf definition or JSON descriptor.\n- The application must load that definition through protobufjs reflection APIs such as descriptor loading.\n- The affected generated-code path must be reached, for example by performing an operation on the loaded type.\n\n## Workarounds\n\nDo not load protobuf definitions or JSON descriptors from untrusted sources with affected versions. If untrusted schemas must be accepted, validate or restrict them before loading and run schema processing in an isolated environment.","summary":"protobufjs turns schema type names from a loaded protobuf definition or JSON descriptor into generated JavaScript without enough validation. An attacker who controls that schema can run arbitrary JavaScript inside the process that loads it.","severity":"critical","cvss":9.8,"epss":0.00774,"exploited":false,"exploited_at":null,"products":[{"name":"protobufjs","fixed":["8.0.1"],"affected":">= 8.0.0, < 8.0.1","ecosystem":"npm"},{"name":"protobufjs","fixed":["7.5.5"],"affected":">= 7.0.0, < 7.5.5","ecosystem":"npm"},{"name":"protobufjs","fixed":["6.11.6"],"affected":"< 6.11.6","ecosystem":"npm"},{"name":"protobufjs project protobufjs","fixed":["7.5.5"],"affected":"< 7.5.5","ecosystem":"vendor"},{"name":"protobufjs project protobufjs","fixed":[],"affected":"= 8.0.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-94","grpc","node.js","npm","package","protobufjs"],"not_affected_if":["managed-hosting","no-descriptor-loading","trusted-schemas-only"],"how_to_check":"- Run `npm ls protobufjs` in each project to see which version is installed.\n- Look for applications that load `.proto` files or JSON descriptors from users, uploads, or other untrusted sources.\n- Check that the installed version is at or above the fixed version for its line.","fix":"- `8.0.1` for the 8.0.x line\n- `7.5.5` for the 7.x line\n- `6.11.6` for versions below 6.11.6","status":"open","published_at":"2026-04-16T22:34:57+00:00","first_seen_at":"2026-11-04T17:15:41+00:00","triaged_at":"2026-11-04T17:16:16+00:00","updated_at":"2026-11-04T17:28:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T17:16:16Z","model":"claude-haiku-5-5","output":{"fix":"- `8.0.1` for the 8.0.x line\n- `7.5.5` for the 7.x line\n- `6.11.6` for versions below 6.11.6","reach":"network","title":"protobufjs: crafted JSON descriptor lets an attacker run JavaScript","impact":"high","summary":"protobufjs turns schema type names from a loaded protobuf definition or JSON descriptor into generated JavaScript without enough validation. An attacker who controls that schema can run arbitrary JavaScript inside the process that loads it.","audience":"developers","category":"package","nicknames":[],"who_cares":["protobufjs","node.js","npm","grpc"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary JavaScript in the host Node.js process","analyst_note":"","how_to_check":"- Run `npm ls protobufjs` in each project to see which version is installed.\n- Look for applications that load `.proto` files or JSON descriptors from users, uploads, or other untrusted sources.\n- Check that the installed version is at or above the fixed version for its line.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-schemas-only","no-descriptor-loading","managed-hosting"],"who_is_affected":"Exposure requires that the application lets an attacker supply or influence a protobuf definition or JSON descriptor and then loads it through protobufjs reflection APIs such as descriptor loading, and then reaches the affected generated-code path, for example by operating on the loaded type. Applications that only decode messages with trusted, application-defined schemas are not directly affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000765,"input_tokens":4612,"output_tokens":607,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-41242':10A,18A '-94':29B '2v4x':14A '88gg':15A 'abl':121C 'accept':233C 'affect':159C,195C,226C 'allow':167C 'api':189C 'applic':118C,145C,153C,165C,181C 'application-defin':152C 'arbitrari':4A,62B,124C 'attack':55B,105C,169C 'code':5A,75C,98C,198C 'context':128C 'control':57B,89C,136C,171C 'could':71C,95C 'craft':84C 'cve':8A,16A 'cwe':28B 'decod':148C 'defin':154C 'definit':44B,112C,176C,185C,218C 'deriv':76C 'descriptor':47B,86C,115C,142C,179C,192C,221C 'direct':158C 'enough':52B 'environ':247C 'exampl':204C 'execut':6A,72C,123C 'generat':49B,73C,99C,197C 'generated-cod':196C 'ghsa':12A 'ghsa-xq3m-2v4x-88gg':11A 'grpc':30B 'impact':103C 'influenc':173C 'insid':64B 'isol':246C 'issu':7A,162C 'javascript':50B,63B,74C,125C 'json':46B,85C,114C,178C,220C 'load':42B,68B,82C,144C,183C,193C,211C,216C,239C 'malici':110C 'may':119C 'messag':149C 'metadata':80C 'must':166C,182C,200C,231C 'name':39B,91C 'node.js':31B 'npm':32B 'oper':208C 'packag':33B 'path':199C 'perform':206C 'precondit':163C 'process':66B,131C,243C 'project':23A,26A 'protobuf':43B,78C,111C,139C,175C,217C 'protobufj':1A,34B,35B,70C,133C,187C 'protobufjs':19A,20A,21A,22A,24A,25A,27A 'provid':108C 'reach':96C,202C 'refer':94C 'reflect':188C 'requir':135C 'restrict':236C 'run':61B,241C 'runtim':97C 'schema':37B,59B,79C,88C,140C,155C,230C,242C 'schema-control':87C 'sourc':224C 'suffici':101C 'summari':69C 'trust':151C 'turn':36B 'type':38B,90C,93C,212C 'untrust':223C,229C 'use':132C,150C 'valid':53B,102C,234C 'version':227C 'without':51B,100C 'workaround':213C 'xq3m':13A","nicknames":[],"mitigations":[],"who_affected":"Exposure requires that the application lets an attacker supply or influence a protobuf definition or JSON descriptor and then loads it through protobufjs reflection APIs such as descriptor loading, and then reaches the affected generated-code path, for example by operating on the loaded type. Applications that only decode messages with trusted, application-defined schemas are not directly affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["projectprotobufjs","protobufjs","protobufjsprojectprotobufjs"],"ptokens":["project","protobufjs"],"labels":["critical","cwe94","grpc","nodejs","npm","package","protobufjs","vendor"],"campaign_type":null,"first_public_at":"2026-04-16T06:12:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xq3m-2v4x-88gg","url":"https://github.com/advisories/GHSA-xq3m-2v4x-88gg","severity":"critical","published_at":"2026-04-16T22:34:57+00:00","modified_at":"2026-11-04T17:14:43+00:00","first_seen_at":"2026-11-04T17:15:41+00:00","fetched_at":"2026-11-04T17:20:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-41242","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41242","severity":null,"published_at":"2026-04-18T17:16:13+00:00","modified_at":"2026-11-03T17:18:13+00:00","first_seen_at":"2026-11-04T17:28:12+00:00","fetched_at":"2026-11-04T17:28:12+00:00","note":null}],"documents":[{"id":68800,"url":"https://api.github.com/repos/protobufjs/protobuf.js/security-advisories/GHSA-xq3m-2v4x-88gg","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":68801,"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-04-16T06:12:11+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":68802,"url":"https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68803,"url":"https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68804,"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68805,"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":68806,"url":"https://github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}