Bug 2459442 (CVE-2026-41242) - CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields
Summary: CVE-2026-41242 protobufjs: protobufjs: Arbitrary code execution via injected ...
Keywords:
Status: NEW
Alias: CVE-2026-41242
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2463271 2463274 2463353 2463354 2463355 2463356
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-18 17:01 UTC by OSIDB Bzimport
Modified: 2026-04-28 03:11 UTC (History)
39 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-18 17:01:14 UTC 
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Note You need to log in before you can comment on or make changes to this bug.