StackRadar

CVE-2026-41242

Critical

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
109
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
1 of 1
affected package

Arbitrary code execution in protobufjs

Carried by container images the latest versions of 109 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
protobufjsnpm5.0.3, 6.8.6, 6.8.8, 6.8.9+16 more7.5.5106
OSV records
GHSA-xq3m-2v4x-88gg

Charts affected

109 by stars
ChartLatestAffected imagesRadar Score
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs@5.0.3
7.5.5

Open the chart page →

4,967
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
protobufjs@6.8.9
7.5.5

Open the chart page →

3,827
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
protobufjs@6.11.2
7.5.5

Open the chart page →

3,576
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
protobufjs@6.11.3
7.5.5

Open the chart page →

25,394
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
protobufjs@6.10.2
7.5.5

Open the chart page →

2,838
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
protobufjs@7.5.4
7.5.5

Open the chart page →

3,746
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
protobufjs@6.10.2
7.5.5

Open the chart page →

22,665
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
protobufjs@7.2.5
7.5.5

Open the chart page →

6,285
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-41242.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
protobufjs@7.2.4
7.5.5
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
protobufjs@7.2.4
7.5.5
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
protobufjs@7.2.4
7.5.5

Open the chart page →

16,083

Container images carrying it

106 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
louislam/uptime-kuma:2.4.091e963bfda56
protobufjs@7.2.6
7.5.5
1
louislam/uptime-kuma:1.23.1396510915e6be
protobufjs@7.2.6
7.5.5
1
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
protobufjs@7.2.6
7.5.5
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
protobufjs@7.2.6
7.5.5
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
protobufjs@7.0.0
7.5.5
1
mishtinetwork/operator:latestbb3fe67a5f7c
protobufjs@7.3.2
7.5.5
1
mitchxxx/amazon:214e72480ec63a
protobufjs@6.11.3
7.5.5
1
n8nio/n8n:1.86.08b39ed5a2de9
protobufjs@7.4.0
7.5.5
1
n8nio/n8n:1.33.1dd171d45102a
protobufjs@7.2.4
7.5.5
1
nocodb/nocodb:0.301.5d9516f0bf546
protobufjs@7.5.4
7.5.5
1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
protobufjs@6.11.4
7.5.5
1
ooghenekaro/amazon:latest03394ba1d6d8
protobufjs@7.2.3
7.5.5
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
protobufjs@7.3.2
7.5.5
1
outlinewiki/outline:0.82.0494dfb9249a6
protobufjs@7.2.6
7.5.5
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs@5.0.3
7.5.5
1
qxip/qryn:3.2.3977acc9c7a9fd
protobufjs@7.4.0
7.5.5
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
protobufjs@7.4.0
7.5.5
1
roadiehq/community-backstage-image:latestef355bf5b639
protobufjs@6.11.2
7.5.5
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
protobufjs@6.11.2
7.5.5
1
slagattollas/weatherservice-practica:latest68e7f56393fc
protobufjs@6.8.8
7.5.5
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
protobufjs@7.4.0
7.5.5
1
speckle/speckle-server:2.26.379f14a2bf931
protobufjs@7.4.0
7.5.5
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
protobufjs@7.4.0
7.5.5
1
supabase/storage-api:v1.12.0f983fb50bd95
protobufjs@7.4.0
7.5.5
1
temporalio/web:1.14.033cfa863d8ce
protobufjs@6.10.2
7.5.5
1
thecodingmachine/workadventure-back:v1.17.764001369dad5
protobufjs@7.2.4
7.5.5
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
protobufjs@7.2.4
7.5.5
1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
protobufjs@7.2.4
7.5.5
1
thingsboard/tb-js-executor:3.4.113e1eadf8ace
protobufjs@6.11.3
7.5.5
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
protobufjs@6.11.2
7.5.5
1
winfred008/amazon:910a68de5b398
protobufjs@6.11.3
7.5.5
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
protobufjs@7.3.2
7.5.5
1
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
protobufjs@6.10.2
7.5.5
1
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
protobufjs@5.0.3
7.5.5
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
protobufjs@7.4.0
7.5.5
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
protobufjs@7.4.0
7.5.5
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
protobufjs@7.4.0
7.5.5
1
ghcr.io/data-fair/notify:3c739b74dabb0
protobufjs@7.4.0
7.5.5
1
ghcr.io/data-fair/processings:15a9216989707
protobufjs@6.8.6
7.5.5
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
protobufjs@6.10.2
7.5.5
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
protobufjs@7.4.0
7.5.5
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
protobufjs@7.5.3
7.5.5
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
protobufjs@7.5.3
7.5.5
1
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
protobufjs@7.4.0
7.5.5
1
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
protobufjs@7.4.0
7.5.5
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
protobufjs@7.5.4
7.5.5
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobufjs@7.4.0
7.5.5
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
protobufjs@7.2.6
7.5.5
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
protobufjs@7.2.2
7.5.5
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
protobufjs@7.2.2
7.5.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.