Loading vulnerability…
CVE-2026-41242 is an arbitrary code execution vulnerability in protobufjs. protobufjs compiles Protocol Buffers definitions into JavaScript functions. In versions earlier than 7.5.5 and 8.0.1, attacker-controlled content in a protobuf definition's type fields can be incorporated into generated JavaScript and executed when an object is decoded using the malicious definition. The flaw affects applications that load or construct attacker-influenced protobuf schemas or JSON descriptors through protobufjs reflection functionality.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a working exploit and a self-contained vulnerable lab for CVE-2026-41242, a protobuf.js dynamic code-generation/code-injection issue leading to RCE. The main exploit is cve_2026_41242.py, a Python script that targets an HTTP service, first probing /health to fingerprint protobufjs and @protobufjs/codegen versions, then POSTing a malicious JSON protobuf descriptor to /api/process. The exploit abuses unsanitized protobuf type names so generated JavaScript becomes syntactically altered; the injected body uses globalThis.process.mainModule.require('child_process').execSync() to run arbitrary commands and throws an error containing RCE_OUTPUT plus stdout, which the Python script parses and displays. It supports single-command mode and an interactive shell loop. Repository structure: README.md gives setup and usage; REPORT.md is a long-form technical writeup explaining root cause, exploitation mechanics, and patch details; vuln-app/server.js is an intentionally vulnerable Express application exposing /health, /api/process, and /api/schema/load; vuln-app/poc_local.js is a local-only proof of concept that demonstrates code injection without network delivery; package.json/package-lock.json pin protobufjs 7.5.4 and @protobufjs/codegen 2.0.4 to preserve the vulnerable behavior. Main exploit capability is remote command execution against applications that deserialize attacker-controlled protobuf schemas at runtime. Secondary capability is target fingerprinting via /health. The exploit is operational rather than merely demonstrative because it includes a concrete payload path, command execution, output recovery, and interactive reuse, but payload customization is still manual rather than framework-driven.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.