Red Hat Security Advisory

RHSA-2026:8498

General availability of the satellite/iop-remediations-rhel9 container image

Released 2026-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9

Fixes 2 records

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94

TI-2026-23776 CVE-2026-30951 · GHSA-6457-6jrx-69cr

Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type

LOW 39

Sequelize is a Node.js ORM tool.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0048 Published 2026-03-10 Partial fix · 6.37.8 CWE-89