CVE-2026-41242

What it actually does

The vulnerability in protobufjs allows for arbitrary code injection through maliciously crafted protobuf definitions. The library fails to properly sanitize the "type" field during compilation, permitting an attacker to embed executable JavaScript code. This code is then executed with the permissions of the application process when it decodes a message using the compromised definition, leading to remote code execution (RCE).

Why it matters to the business

An attacker exploiting this vulnerability can gain complete control over the affected application and its underlying server. This can result in the theft of sensitive data, deployment of ransomware, complete service disruption, and the compromised system being used as a pivot point for further attacks within the network. The critical CVSS score of 9.8 highlights the severe risk to business operations, data confidentiality, and service availability.

How an attack unfolds

An attacker, who has some level of authenticated access or has found another way to supply files to the application, crafts a malicious protobuf definition file. Within this file, they inject JavaScript code into a message's "type" field. When the target application uses a vulnerable version of the protobufjs library to load and compile this definition, the malicious code is embedded into the generated JavaScript decoding function. The next time the application decodes a protobuf message of that specific type, the injected code executes on the server, granting the attacker RCE.

How to fix it

The primary remediation is to upgrade the protobufjs library to a patched version. Developers should update their dependencies to version 8.0.1, 7.5.5, or any subsequent release. If an immediate upgrade is not feasible, implement strict input validation and sanitization on any externally sourced protobuf definitions to ensure "type" fields do not contain unexpected or executable characters before they are processed by the library.

How to confirm the fix worked

To validate the fix, confirm that all instances of the protobufjs library have been upgraded to version 8.0.1, 7.5.5, or newer. Use a Software Composition Analysis (SCA) tool or run `npm list protobufjs` or `yarn list protobufjs` in project directories to verify the version. To test for exposure in a safe environment, attempt to compile a protobuf definition with a non-standard but non-malicious string in a "type" field; a patched version should reject it or handle it safely without code execution.

Typical attack path

1. Attacker identifies an application using a vulnerable version of protobufjs that accepts user-supplied protobuf definitions.
2. Attacker crafts a protobuf definition file with malicious JavaScript code embedded in a "type" field.
3. Attacker uploads or submits the malicious definition file to the application.
4. The application parses and compiles the malicious definition, creating a compromised decoding function.
5. The application's business logic triggers the decoding of a message using the compromised function.
6. The embedded malicious code executes on the server, leading to a full compromise.

How to detect it

To detect potential exploitation, monitor Node.js applications using protobufjs for anomalous behavior. Look for unexpected child processes spawned by the Node.js process (e.g., sh, bash, curl, wget, powershell.exe) via process monitoring tools like Sysmon or auditd. Review source code repositories and file systems for protobuf definition files (.proto) that contain suspicious code snippets within "type" declarations. Monitor for unusual outbound network connections from application servers, which could indicate a successful compromise and communication with a command-and-control server.

• grep -E 'type\s*=\s*"[^"}]*[(){};'"][^"}]*"' on .proto files
• grep -E 'type\s*=\s*\'[^'}]*[(){};"'][^'}]*\'' on .proto files

What your security team should do

• Immediately use a Software Composition Analysis (SCA) tool to identify all applications and systems using vulnerable versions of protobufjs.
• Prioritize the upgrade of all identified instances to version 8.0.1, 7.5.5, or a later patched version.
• If immediate patching is not possible, audit all applications that accept protobuf definitions from untrusted sources and implement strict validation to block definitions containing code-like characters in 'type' fields.
• Hunt for signs of past compromise by searching for suspicious protobuf definition files and analyzing process execution logs on servers running Node.js applications.