CVE-2026-41242 Details

A vulnerability in protobufjs versions prior to 8.0.1 and 7.5.5 allows attackers to inject arbitrary code into the 'type' fields of protobuf definitions. This injected code is executed during the decoding of objects using those definitions, leading to remote code execution. The vulnerability arises because the library does not properly validate the type names, allowing malicious code to be executed in the context of the application.

Users can upgrade to protobufjs versions 8.0.1 or 7.5.5, both of which address this vulnerability by filtering out invalid characters from type names, preventing the injection of arbitrary code.