Bug 2459442 (CVE-2026-41242)
| Summary: | CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aazores, abarbaro, abuckta, akhatavk, alizardo, amctagga, aoconnor, aos-team-art-private, asdas, bbrownin, bniver, caswilli, cdrage, cmah, dkuc, dpaolell, dschmidt, eaguilar, ebaron, erezende, ewittman, flucifre, gbenhaim, gmeno, groman, janstey, jchui, jdelft, jhe, jkoehler, jlanda, jmatsuok, jolong, jtolenti, jupierce, jwong, kaycoth, kshier, ktsao, lchilton, lgarciaa, lphiri, manissin, mbenjamin, mbiarnes, mhackett, mstipich, nboldt, nipatil, niyer, oaljalju, omaciel, orabin, pantinor, pjindal, ppalepu, ppostler, prdhamdh, psrna, rexwhite, rhel-process-autobot, rkubis, rushinde, sdawley, sfeifer, sghai, sidsharm, simaishi, smcdonal, sostapov, stcannon, sthirugn, suppawar, teagle, ttakamiy, twaugh, vereddy, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in protobufjs, a JavaScript (JS) library used for compiling protobuf definitions. A remote attacker with low privileges can exploit this vulnerability by injecting arbitrary code into the "type" fields of protobuf definitions. This malicious code will then execute during the object decoding process, leading to arbitrary code execution and potentially full system compromise.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2463271, 2463274, 2463353, 2463354, 2463355, 2463356 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-04-18 17:01:14 UTC
|