CVE-2026-41242 affects protobuf.js, a library that compiles protobuf definitions into JavaScript functions. In versions before 7.5.5, an attacker can inject arbitrary code into the "type" fields of protobuf definitions. This injected code executes during the decoding process of objects using those definitions, resulting in a critical code injection vulnerability (CWE-94). The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Versions 7.5.5 and 8.0.1 include patches that fix this issue. Red Hat advisories reference this CVE and provide additional context but do not explicitly state new patches beyond the version fixes.

Successful exploitation allows an attacker to execute arbitrary code during the decoding of protobuf objects, potentially leading to full compromise of the application using protobuf.js. The vulnerability is critical due to the high impact on confidentiality, integrity, and availability, as reflected by the CVSS score of 9.4.

Upgrade protobuf.js to version 7.5.5 or later, as these versions include patches that fix the code injection vulnerability. Since the vendor advisory and CVE description confirm the fix in 7.5.5 and 8.0.1, applying these updates is the recommended remediation. No additional mitigations or temporary fixes are documented in the vendor advisory.