CVE-2026-41242

This repository does not have a README...

CVE-2025-41242

⚠️ Security Research & Legal Disclaimer 📌 Purpose of This Repository This repository is provided strictly for educational, academic, and authorized cybersecurity research purposes only. It is intended to support understanding of: Security vulnerabilities and exploitation concepts in controlled...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

ROOT-APP-MAVEN-CVE-2025-41242 CVE-2025-41242 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2025-41242 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

K000162249: Spring Framework Path Traversal vulnerability CVE-2025-41242

Security Advisory Description Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: the application is deployed as a WAR or with an embedded...

Linux Distros Unpatched Vulnerability : CVE-2026-41242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - protobufjs compiles protobuf definitions into JavaScript JS functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the type...

CVE-2026-41242 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-centraldashboard, langfuse, pulumi, vitess, jitsucom-jitsu...

CVE-2026-41242 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, kibana, gemini-cli, pulumi, renovate, langfuse-fips, librechat, jitsucom-jitsu, nemo, vitess, opentelemetry-auto-instrumentations-node, langfuse...

CVE-2026-41242

protobufjs compiles protobuf definitions into JavaScript JS functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the...

CVE-2026-41242

protobufjs compiles protobuf definitions into JavaScript JS functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +22793 more potentially affected by CVE-2026-41242 via protobufjs (>=2.0.4, <=7.5.4)

protobufjs NPM version =2.0.4, =0.0.2, =0.0.1, =1.0.0, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =1.0.0-alpha.3, =1.0.0, =0.0.1, =0.0.1, =0.1.5 and more Source cves: CVE-2026-41242 Source advisory: MEND:CVE-2026-41242...

CVE-2026-41242

creationtimestamp| type| source ---|---|--- 2026-04-17 04:00:00+00:00| published-proof-of-concept| https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-xq3m-2v4x-88gg 2026-04-18 19:15:08+00:00| published-proof-of-concept| Telegram/x12vbbUj9eUCE8CmwEAAyNGNCB8MsPtTe6lQq2voLeHmZk...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +704 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3327 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =3.26.0, =3.142.0 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +704 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3327 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =3.26.0, =3.142.0 and more Source cves: CVE-2026-41242 Source advisory: OSV:GHSA-XQ3M-2V4X-88GG...

2mxdev-gql-gateway (1.0.0), 4m-node-server (>=0.0.1, <=0.0.8) +2884 more potentially affected by CVE-2026-41242 via @apollo/protobufjs (>=1.1.0, <=1.2.7)

@apollo/protobufjs NPM version =1.1.0, =0.0.1, =1.0.2, =3.10.1, =1.2.0-pre.24, =1.0.1, =1.0.0, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =1.0.17 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-APOLLOPROTOBUFJS-16321047...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +704 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

3id-test-helper (>=1.0.0, <=1.0.4), @00ssh/erdnest (>=0.2.19, <=0.2.23) +3549 more potentially affected by CVE-2026-41242 via protobufjs (>=6.8.0, <=6.11.4)

protobufjs NPM version =6.8.0, =1.0.0, =0.2.19, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.1.0, =0.0.8-alpha.0, =0.1.0, =0.0.2, =0.0.1, =1.0.7, =1.0.13 - @account-coddle/pokerfire 0.0.1 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

org.webjars.npm:bazel__typescript (1.7.0), org.webjars.npm:cesium (>=1.96.0, <=1.144.0) +13 more potentially affected by CVE-2026-41242 via org.webjars.npm:protobufjs (>=6.8.8, <=8.7.2)

org.webjars.npm:protobufjs MAVEN version =6.8.8, =1.96.0, =1.0.0, =1.0.0, =10.13.0, =4.7.0, =0.3.35, =1.6.1, =0.5.2, =0.7.15 - org.webjars.npm:tiktok-live-connector 1.0.2 Source cves: CVE-2026-41242 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16094666...