CVE-2026-41242

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.4EPSS <1%

Published 2026-04-18Updated 2026-04-27

PoC

Vulnerability details

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVE Organization The Hacker News NVD Analysis RedHat Vuln DB

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated