EUVD-2026-23678
GHSA-xq3m-2v4x-88gg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to target application
-
DeliveryUpload malicious protobuf definition with injected code in 'type' field
-
ExploitApplication compiles definition using vulnerable protobufjs
-
ExecutionTrigger message decode operation
-
PersistInjected JavaScript executes in application context
-
ImpactArbitrary code execution with application privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have authenticated access (PR:L) to inject or upload malicious protobuf definitions that the application will compile using protobufjs. Specifically, exploitation requires: (1) the target application accepts protobuf schema definitions from the attacker either directly (via API endpoint, configuration interface, file upload) or indirectly (shared schema repository, supply chain injection into schema sources), (2) the application uses protobufjs versions prior to 7.5.5/8.0.1 to compile these definitions into JavaScript decoders, and (3) the application subsequently invokes the generated decoder functions (simply compiling the schema is insufficient-decoding operations must occur to trigger execution). Network accessibility (AV:N) means the attacker can deliver malicious schemas remotely without local system access. No user interaction required (UI:N) once the attacker has schema injection capability. Exploitation is LIMITED by the authentication requirement (not remotely exploitable by unauthenticated attackers) and by architectural choices about who can supply protobuf definitions-applications that only compile hardcoded or administrator-controlled schemas are not vulnerable regardless of library version. |
| Impact | Real-world risk is HIGH but context-dependent. CVSS 9.4 accurately reflects the severe technical impact: arbitrary code execution with high confidentiality, integrity, and availability impact across system and subsequent boundaries (scope change indicated by SC:H/SI:H/SA:H metrics). However, exploitation requires PR:L (low-privileged authenticated access) to inject malicious protobuf definitions into the compilation process. This significantly limits attack surface compared to unauthenticated vulnerabilities. Risk is CRITICAL in scenarios where applications accept protobuf schemas from semi-trusted users (API gateway configurations, multi-tenant platforms, development tools with shared schema repositories). Risk is MODERATE in environments where only administrators define protobuf schemas. No CISA KEV listing and no public POC identified at time of analysis suggests exploitation is not yet widespread, but the technical barrier is low given clear injection vector. SSVC decision factors: Exploitation status is 'POC' (patches and detailed advisory available reveal attack mechanism), Automatable is 'yes' (once attacker has schema injection access, exploitation is straightforward), Technical Impact is 'total' (arbitrary code execution). Priority should be HIGH for any deployment where non-administrators can influence protobuf definitions, MEDIUM otherwise. EPSS data not provided, but given clear attack path and wide library deployment, expect moderate-to-high scoring once added to EPSS corpus. |
| Exploit ScenarioDerived | An attacker with low-privileged authenticated access to a Node.js API gateway submits a malicious protobuf definition file where the 'type' field contains JavaScript code (e.g., ''; require('child_process').exec('malicious_command'); //'). The application uses protobufjs to compile this definition into a message decoder. When the application or any user subsequently decodes a protobuf message using the poisoned definition, the injected code executes with the privileges of the Node.js process, potentially exfiltrating environment variables, accessing databases, or establishing reverse shells. Public exploit code has not been identified, but the GitHub security advisory and patch commits reveal sufficient technical detail for adversaries to develop exploits. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 18, 2026
Code injection vulnerability in protobufjs (JavaScript protobuf library) allows authenticated attackers to execute arbitrary JavaScript code during protobuf object decoding by injecting malicious payloads into 'type' fields of protobuf definitions. Affects all versions before 7.5.5 and 8.0.1. CVSS 9.4 (Critical) reflects chained impact across multiple security boundaries (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), though exploitation requires authenticated access (PR:L) to inject malicious protobuf definitions. No active exploitation confirmed (not in CISA KEV); vendor-released patches available.
RemediationAI
Upgrade immediately to protobufjs version 7.5.5 (for 7.x users) or 8.0.1 (for 8.x users), available at https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5 and https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1 respectively. Vendor-released patches in commits 535df444ac and ff7b2afef8 implement input validation to sanitize 'type' fields before code generation. If immediate patching is not feasible, implement compensating controls: restrict protobuf definition sources to trusted administrators only (eliminate user-supplied or external schema sources), implement strict input validation on any protobuf schema uploads or API endpoints that accept .proto files, run protobuf compilation processes in sandboxed environments with minimal privileges (containers with restricted capabilities, separate service accounts with no access to sensitive data), and deploy runtime application self-protection (RASP) or Content Security Policy (CSP) in browser contexts to limit damage from successful code injection. Note that access control changes may break legitimate workflows where developers or API consumers provide schemas; evaluate business impact before deployment. Schema validation alone is insufficient if attackers can bypass filters-patching remains the definitive solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Protobufjs (protobuf.js) is a widely-used JavaScript implementation of Protocol Buffers, Google's data serialization format. The library compiles .proto definition files into JavaScript code for efficient encoding/decoding. This vulnerability stems from CWE-94 (Improper Control of Generation of Code), specifically insufficient sanitization of the 'type' field in protobuf schema definitions before code generation. When protobufjs compiles a malicious protobuf definition containing injected JavaScript in type fields, that code becomes part of the generated decoder function. Subsequent calls to decode messages using the compromised definition trigger execution of the attacker-controlled code within the Node.js or browser JavaScript runtime. The CPE identifies protobufjs (protobuf.js) library across all versions prior to the patches, affecting any application that accepts and compiles user-supplied or untrusted protobuf definitions.
Know when Protobufjs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Blast Radius
ecosystem impact- 1,832 npm packages depend on protobufjs (158 direct, 1,675 indirect)
Ecosystem-wide dependent count for version 8.0.0.
Articles & Coverage 1
Executive ViewAI
CVE-2026-41242 is a critical code injection vulnerability in protobufjs that enables authenticated attackers to execute arbitrary JavaScript code during protobuf decoding, potentially compromising any application using affected versions (pre-7.5.5 and pre-8.0.1). Organizations using protobufjs in production environments face immediate risk of application compromise if internal users or connected services can manipulate protobuf definitions.
Vendor-released patch: protobufjs version 7.5.5 or 8.0.1 or later. Interim mitigations pending patch deployment: restrict network and API access to services that accept protobuf definitions to authenticated internal users only; implement input validation and sanitization of all protobuf definition sources; disable dynamic protobuf definition loading where possible and use only pre-compiled, static definitions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Protobufjs
View all"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify pro
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Rated medium severity (CVSS 5.5), this vuln
Denial-of-service via infinite loop in protobuf.js (the pure-JavaScript Protocol Buffers implementation for Node.js/brow
Uncontrolled recursion in protobufjs versions prior to 7.5.8 and 8.2.0 allows remote attackers to exhaust the JavaScript
Prototype pollution in protobuf.js versions 8.2.0 through 8.6.4 allows network-reachable attackers to corrupt JavaScript
Exploit-DB