Red Hat Security Advisory

RHSA-2026:24331

cockpit-image-builder security update

Released 2026-06-08 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) cockpit-image-builder-94.3-1.el10_2

Fixes 2 records

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94

TI-2025-12309 CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

MEDIUM 40

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01823 Published 2026-01-21 Partial fix · 4.17.23, 4.18.0 CWE-1321