CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Overview protobuf.js npm: protobufjs versions ≤ 7.5.4 and ≤ 8.0.0 are vulnerable to arbitrary code execution via type names in the protobuf schema. The @protobufjs/codegen module concatenates type names...

quokka

Quokka image generated by DALL-E Table of Contents Introduction Installation Usage Building Documentation FAQ Introduction Quokka is a binary exporter: from the disassembly of a program, it generates an export file that can be used without the disassembler. It currently supports IDA Pro , Ghidra...

PYSEC-2026-4205 datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory

Summary When processing an attacker-controlled Protobuf schema, vulnerable versions of datamodel-code-generator could write a generated weak-import stub outside the intended weakimports temporary directory. Absolute import paths and relative paths containing .. could escape this directory. An...

Linux Distros Unpatched Vulnerability : CVE-2026-107377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply...

com.squareup.wire:wire-grpc-client (4.5.5), com.squareup.wire:wire-schema (4.5.5) +3 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.5.5)

com.squareup.wire:wire-runtime MAVEN version 4.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.5 - com.squareup.wire:wire-schema 4.5.5 -...

com.squareup.wire:wire-grpc-client (4.9.1), com.squareup.wire:wire-schema (4.9.1) +8 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.1)

com.squareup.wire:wire-runtime MAVEN version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.1 - com.squareup.wire:wire-schema 4.9.1 -...

com.squareup.wire:wire-grpc-client (4.9.11), com.squareup.wire:wire-schema (4.9.11) +4 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (4.9.11)

com.squareup.wire:wire-runtime MAVEN version 4.9.11 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.9.11 - com.squareup.wire:wire-schema 4.9.11 -...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via schema option path handling. An attacker can perform prototype pollution by supplying a crafted protobuf schema or JSON descriptor whose option paths traverse inherited properties, allowing writes to global...

Malicious code in @asyncapi/protobuf-schema-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927e5dcfc89c461512068769c97bb06898751cd42cd15f50d97c4760c658269b The package @asyncapi/protobuf-schema-parser was found to contain malicious code. Source: ghsa-malware...

com.squareup.wire:wire-grpc-client (4.5.5), com.squareup.wire:wire-schema (4.5.5) +3 more potentially affected by CVE-2024-58103 via com.squareup.wire:wire-runtime (4.5.5)

com.squareup.wire:wire-runtime MAVEN version 4.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.squareup.wire:wire-runtime and may be impacted: - com.squareup.wire:wire-grpc-client 4.5.5 - com.squareup.wire:wire-schema 4.5.5 -...