Red Hat Security Advisory

RHSA-2026:19167

pcs security update

Released 2026-05-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.11-2.el9_8.1, pcs-snmp-0.11.11-2.el9_8.1
Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.11-2.el9_8.1, pcs-snmp-0.11.11-2.el9_8.1

Fixes 1 record

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94