by Kastro CVE-2026-41242
protobufjs protobuf.js — protobufjs has an arbitrary code execution issue
Description · from the CVE record
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
Affected
ProductAffectedFixed inSource
protobuf.js< 7.5.5–CNA
protobuf.js>= 8.0.0-experimental, < 8.0.1–CNA
Red Hat Developer Hub 1.8see advisory1779841586redhat-SADP
Red Hat Developer Hub 1.9see advisory1781187342redhat-SADP
Red Hat OpenShift AI 2.25see advisory1780467029redhat-SADP
Red Hat OpenShift AI 2.25see advisory1780467147redhat-SADP
Red Hat OpenShift AI 3.3see advisory1783082680redhat-SADP
Red Hat OpenShift Dev Spaces 3.30see advisory1787762793redhat-SADP
Cryostat 4see advisory–redhat-SADP
OpenShift Pipelinessee advisory–redhat-SADP
OpenShift Pipelinessee advisory–redhat-SADP
OpenShift Service Mesh 3see advisory–redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
redhat-SADP (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total