CVE-2026-41242

A flaw was found in protobufjs, a JavaScript (JS) library used for compiling protobuf definitions. A remote attacker with low privileges can exploit this vulnerability by injecting arbitrary code into the "type" fields of protobuf definitions. This malicious code will then execute during the object decoding process, leading to arbitrary code execution and potentially full system compromise.

This Important impact remote code execution vulnerability in protobufjs allows attackers to inject arbitrary code into the 'type' fields of protobuf definitions, which executes during object decoding. Red Hat products that process untrusted protobuf definitions using the affected library versions are at risk. Red Hat has assessed this at IMPORTANT (not Critical) as exploitation requires low privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.