CVE-2026-41242
Full vulnerability record from the local CVENow database.
Description
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue.
Severity
CRITICAL
CVSS score
9.4
(v4.0)
Vulnerability status
Modified
Source identifier
Published
2026-04-18 17:16:13.983000
Last modified
2026-11-03 17:18:13.750000
View original CVE JSON
{
"id": "CVE-2026-41242",
"sourceIdentifier": "[email protected]",
"published": "2026-04-18T17:16:13.983",
"lastModified": "2026-11-03T17:18:13.750",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the \"type\" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1, 7.5.5, and 6.11.6 patch the issue."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "protobufjs",
"product": "protobuf.js",
"versions": [
{
"version": ">= 7.0.0, < 7.5.5",
"status": "affected"
},
{
"version": ">= 8.0.0-experimental, < 8.0.1",
"status": "affected"
},
{
"version": "< 6.11.6",
"status": "affected"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.8",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.8::el9"
],
"versions": [
{
"version": "1779841586",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub 1.9",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhdh/rhdh-hub-rhel9",
"cpes": [
"cpe:/a:redhat:rhdh:1.9::el9"
],
"versions": [
{
"version": "1781187342",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-dashboard-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"versions": [
{
"version": "1780467029",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"versions": [
{
"version": "1780467147",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 3.3",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "rhoai/odh-mod-arch-maas-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"versions": [
{
"version": "1783082680",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.30",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "devspaces/code-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.30::el9"
],
"versions": [
{
"version": "1787762793",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Cryostat 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana-infinity-datasource-npm",
"cpes": [
"cpe:/a:redhat:cryostat:4"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Pipelines",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Pipelines",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Service Mesh 3",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-service-mesh/kiali-ossmc-rhel9",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
]
},
{
"vendor": "Red Hat",
"product": "OpenShift Service Mesh 3",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift-service-mesh/kiali-rhel9",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "automation-platform-ui",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat build of Apicurio Registry 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "apicurio/apicurio-studio-ui-rhel8",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Podman Desktop",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman-desktop-macos-1-0",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Podman Desktop",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "podman-desktop-windows-1-0",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Build of Podman Desktop",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rh-podman-desktop.git",
"cpes": [
"cpe:/a:redhat:podman_desktop:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ceph Storage 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhceph/alloy-rhel10",
"cpes": [
"cpe:/a:redhat:ceph_storage:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Developer Hub",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor",
"cpes": [
"cpe:/a:redhat:rhdh:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "grafana",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-gaudi-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/bootc-rocm-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "dotnet9.0",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-dashboard-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-kf-notebook-controller-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mlflow-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-notebook-controller-rhel8",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_ai"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-console",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "openshift4/ose-console-rhel9",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "redhat-user-workloads/art-images",
"cpes": [
"cpe:/a:redhat:openshift:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Openshift Data Foundation 4",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "odf4/mcg-core-rhel9",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
]
},
{
"vendor": "Red Hat",
"product": "Self-service automation portal 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform/automation-portal",
"cpes": [
"cpe:/a:redhat:ansible_portal:2"
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-20T16:03:39.054181Z",
"id": "CVE-2026-41242",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:protobufjs_project:protobufjs:*:*:*:*:*:node.js:*:*",
"versionEndExcluding": "7.5.5",
"matchCriteriaId": "B33F3644-D8EE-4332-8792-C4C309241B27"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:protobufjs_project:protobufjs:8.0.0:*:*:*:*:node.js:*:*",
"matchCriteriaId": "0C88A330-1152-4C46-B3AA-11AA07A9F0A9"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:21338",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:24977",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26234",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37275",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:62260",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41242",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459442",
"source": "[email protected]"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/086916b4a52c9f73ce88956edbb38fc902e54bbf",
"source": "[email protected]"
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg",
"source": "[email protected]",
"tags": [
"Exploit",
"Vendor Advisory"
]
},
{
"url": "https://github.com/protobufjs/protobuf.js/tree/v6.11.6",
"source": "[email protected]"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:21338",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:24977",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26234",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37275",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:62260",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-41242",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459442",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41242.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
]
}