Exploit for Code Injection in Protobufjs_Project Protobufjs

🗓️ 07 Aug 2026 14:38:16Reported by GiangdurianType

Protobuf.js up to 7.5.4 and 8.0.0 allows remote code execution via schema type names; fixed in 7.5.5 and 8.0.1.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	12 Jun 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 May 202605:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality (CVE-2026-41242, CVE-2026-4800) and denial of service (CVE-2026-27141)	21 May 202618:39	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	12 Jun 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	17 Jun 202615:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules	22 May 202608:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	24 Aug 202615:36	–	ibm
ATTACKERKB	CVE-2026-41242	18 Apr 202616:18	–	attackerkb
BDU FSTEC	The vulnerability of the library for working with the Protocol Buffers protocol protobufjs, related to incorrect code generation management, allows a hacker to execute arbitrary code.	20 Apr 202600:00	–	bdu_fstec
Chainguard	CVE-2026-41242 vulnerabilities	19 Apr 202619:17	–	cgr

07 Aug 2026 14:40Current

7High risk

Vulners AI Score7

CVSS 3.18.8 - 9.8

CVSS 49.4

EPSS0.00745

SSVC