CVE-2026-41242 — protobuf.js Code Injection to RCE

CVSS 9.4 (Critical) | Code Injection (CWE-94)

Overview

protobuf.js (npm: protobufjs) versions ≤ 7.5.4 and ≤ 8.0.0 are vulnerable to arbitrary code execution via type names in the protobuf schema. The @protobufjs/codegen module concatenates type names directly into a JavaScript string and then runs it through the Function() constructor (equivalent to eval()). An attacker who controls the schema can inject code that runs on the server.

Patched: protobufjs 7.5.5 / 8.0.1

Directory structure

CVE-2026-41242/
├── REPORT.md               # Báo cáo phân tích đầy đủ
├── cve_2026_41242.py        # Script exploit (Python)
├── vuln-app/                # Ứng dụng Node.js vulnerable
│   ├── server.js            # Express server
│   ├── poc_local.js         # PoC local — chứng minh code injection
│   ├── package.json
│   └── package-lock.json
└── img/                     # Screenshots
    └── *.png                # setup, recon, exploit, debug, patch