GHSA-XQ3M-2V4X-88GG Arbitrary code execution in protobufjs

🗓️ 16 Apr 2026 22:34:57Reported by GoogleType

osv🔗 osv.dev👁 87 Views

Arbitrary remote code execution in protobufjs via malicious protobuf definitions exploiting type fields during decoding.

Reporter	Title	Published	Views	Family All 64
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	12 Jun 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	19 May 202605:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality (CVE-2026-41242, CVE-2026-4800) and denial of service (CVE-2026-27141)	21 May 202618:39	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials	12 Jun 202601:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	17 Jun 202615:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules	22 May 202608:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	24 Aug 202615:36	–	ibm
GithubExploit	Exploit for Code Injection in Protobufjs_Project Protobufjs	7 Aug 202614:38	–	githubexploit
ATTACKERKB	CVE-2026-41242	18 Apr 202616:18	–	attackerkb
BDU FSTEC	The vulnerability of the library for working with the Protocol Buffers protocol protobufjs, related to incorrect code generation management, allows a hacker to execute arbitrary code.	20 Apr 202600:00	–	bdu_fstec

Source	Link
github	www.github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41242
github	www.github.com/protobufjs/protobuf.js/commit/535df444ac060243722ac5d672db205e5c531d75
github	www.github.com/protobufjs/protobuf.js/commit/ff7b2afef8754837cc6dc64c864cd111ab477956
github	www.github.com/protobufjs/protobuf.js
github	www.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.5
github	www.github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.1

05 May 2026 16:12Current

6.3Medium risk

Vulners AI Score6.3

CVSS 49.4

CVSS 3.19.8

EPSS0.00745