Read the docs
TI-2026-04185 Aliases CVE-2026-4800GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

Priority MEDIUM 48CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 71 fixed, 34 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02808 86th percentileScored 2026-11-07
Fix Partial lodash (lodash): 4.18.1lodash-es (lodash): 4.18.1+6 more productsRed Hat: 78 advisoriesRed Hat: 71 fixed, 34 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lodashlodash4.0.0 to before 4.18.14.18.1Patch availableCNA
lodashlodash-es4.0.0 to before 4.18.14.18.1Patch availableCNA
lodashlodash-amd4.0.0 to before 4.18.14.18.1Patch availableCNA
lodashlodash.template4.0.0 to before 4.18.14.18.1Patch availableCNA
—lodash (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-r5fr-rjxr-66jc
—lodash-es (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-r5fr-rjxr-66jc
—lodash-amd (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-r5fr-rjxr-66jc
—lodash.template (npm)4.0.0 to before 4.18.04.18.0Patch availableGHSA-r5fr-rjxr-66jc
  • lodash Vendorlodash Affected 4.0.0 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
  • lodash-es Vendorlodash Affected 4.0.0 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
  • lodash-amd Vendorlodash Affected 4.0.0 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
  • lodash.template Vendorlodash Affected 4.0.0 to before 4.18.1 Fixed in 4.18.1 Patch available CNA
  • lodash (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-r5fr-rjxr-66jc
  • lodash-es (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-r5fr-rjxr-66jc
  • lodash-amd (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-r5fr-rjxr-66jc
  • lodash.template (npm) Vendor— Affected 4.0.0 to before 4.18.0 Fixed in 4.18.0 Patch available GHSA-r5fr-rjxr-66jc

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*4.0.0 to before 4.18.0Vulnerablelodash
cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*4.0.0 to before 4.18.0Vulnerablelodash
cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*4.0.0 to before 4.18.0Vulnerablelodash
cpe:2.3:a:lodash:lodash.template:*:*:*:*:*:node.js:*:*4.0.0 to before 4.18.0Vulnerablelodash
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.18.0 Vulnerable ·lodash
  • cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.18.0 Vulnerable ·lodash
  • cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.18.0 Vulnerable ·lodash
  • cpe:2.3:a:lodash:lodash.template:*:*:*:*:*:node.js:*:* Versions 4.0.0 to before 4.18.0 Vulnerable ·lodash

Remediation

  • Fix · CNA lodash (lodash) Fixed in 4.18.1
  • Fix · CNA lodash-es (lodash) Fixed in 4.18.1
  • Fix · CNA lodash-amd (lodash) Fixed in 4.18.1
  • Fix · CNA lodash.template (lodash) Fixed in 4.18.1
  • Fix · GHSA-r5fr-rjxr-66jc lodash (npm) Fixed in 4.18.0 Advisory →
  • Fix · GHSA-r5fr-rjxr-66jc lodash-es (npm) Fixed in 4.18.0 Advisory →
  • Fix · GHSA-r5fr-rjxr-66jc lodash-amd (npm) Fixed in 4.18.0 Advisory →
  • Fix · GHSA-r5fr-rjxr-66jc lodash.template (npm) Fixed in 4.18.0 Advisory →

Red Hat 78 advisories

  • RHSA-2026:83622 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:83619 Released 2026-10-15 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.36 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:83598 Released 2026-10-15 · Red Hat rating Important
    RHTAS 1.4.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
Show 75 more Red Hat advisories
  • RHSA-2026:68754 Released 2026-09-17 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.1 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +2
  • RHSA-2026:59833 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.12.97 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:60023 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/egress-router-cni-rhel9, registry.redhat.io/openshift4/frr-rhel9, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9 +20
  • RHSA-2026:56912 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.15.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
  • RHSA-2026:56854 Released 2026-08-26 · Red Hat rating Important
    OpenShift Container Platform 4.16.69 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:56789 Released 2026-08-26 · Red Hat rating Critical
    OpenShift Container Platform 4.14.72 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
  • RHSA-2026:54188 Released 2026-08-20 · Red Hat rating Important
    OpenShift Container Platform 4.13.70 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-console, registry.redhat.io/openshift4/ose-oauth-proxy
  • RHSA-2026:48699 Released 2026-08-05 · Red Hat rating Critical
    OpenShift Container Platform 4.18.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9 +1
  • RHSA-2026:44235 Released 2026-07-29 · Red Hat rating Important
    OpenShift Container Platform 4.19.40 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-console-rhel9 +2
  • RHSA-2026:40795 Released 2026-07-21 · Red Hat rating Important
    OpenShift Container Platform 4.20.30 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9
  • RHSA-2026:42078 Released 2026-07-20 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 ansible-core-1:2.16.19-1.el8ap, ansible-test-1:2.16.19-1.el8ap, automation-controller-4.6.30-2.el8ap +24
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 ansible-core-1:2.16.19-1.el9ap, ansible-test-1:2.16.19-1.el9ap, automation-controller-4.6.30-2.el9ap +24
  • RHSA-2026:41944 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:41941 Released 2026-07-20 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.25 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:40984 Released 2026-07-16 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:40945 Released 2026-07-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:36621 Released 2026-07-16 · Red Hat rating Important
    OpenShift Container Platform 4.16.66 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9 +4
  • RHSA-2026:40118 Released 2026-07-15 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.3 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:37186 Released 2026-07-14 · Red Hat rating Important
    OpenShift Container Platform 4.21.24 bug fix and security update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:34100 Released 2026-07-09 · Red Hat rating Important
    OpenShift Container Platform 4.17.55 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9 +6
  • RHSA-2026:36651 Released 2026-07-08 · Red Hat rating Important
    Red Hat Edge Manager Version 1.0.3 Security Update
    • Red Hat Edge Manager 1.0 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +9
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:34342 Released 2026-07-01 · Red Hat rating Critical
    Cluster Observability Operator 1.5.0
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 +9
  • RHSA-2026:29795 Released 2026-06-30 · Red Hat rating Important
    OpenShift Container Platform 4.22.3 bug fix and security update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
  • RHSA-2026:24977 Released 2026-06-10 · Red Hat rating Important
    RHOAI 2.25.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +34
  • RHSA-2026:24762 Released 2026-06-09 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 python3-click-8.3.3-1.el10ap, receptor-1.6.5-1.el10ap, receptorctl-1.6.5-1.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.12-1.el9ap, automation-controller-cli-4.7.12-1.el9ap, automation-controller-server-4.7.12-1.el9ap +10
  • RHSA-2026:24331 Released 2026-06-08 · Red Hat rating Important
    cockpit-image-builder security update
    • Red Hat Enterprise Linux AppStream (v. 10) cockpit-image-builder-94.3-1.el10_2
  • RHSA-2026:21658 Released 2026-06-03 · Red Hat rating Important
    OpenShift Container Platform 4.18.43 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-cluster-nfd-rhel9-operator +5
  • RHSA-2026:22619 Released 2026-06-02 · Red Hat rating Important
    Red Hat Data Grid 8.6.1 security update
    • Red Hat Data Grid 8.6.1
  • RHSA-2026:20041 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
  • RHSA-2026:20042 Released 2026-05-27 · Red Hat rating Important
    OpenShift Container Platform 4.19.32 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9, registry.redhat.io/openshift4/ose-dpu-cni-rhel9 +5
  • RHSA-2026:20946 Released 2026-05-26 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.6 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/console-plugin-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8, registry.redhat.io/openshift-gitops-1/gitops-rhel8
  • RHSA-2026:20943 Released 2026-05-26 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.19.4 security update
    • Red Hat OpenShift GitOps 1.19 registry.redhat.io/openshift-gitops-1/argocd-image-updater-rhel8, registry.redhat.io/openshift-gitops-1/console-plugin-rhel8, registry.redhat.io/openshift-gitops-1/dex-rhel8 +1
  • RHSA-2026:17789 Released 2026-05-26 · Red Hat rating Important
    Red Hat build of Cryostat 4.2.0: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:17598 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.17.54 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2026:17448 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.18.42 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9, registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9, registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9-operator +1
  • RHSA-2026:17468 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 bug fix and security update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +14
  • RHSA-2026:17469 Released 2026-05-20 · Red Hat rating Important
    OpenShift Container Platform 4.20.23 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9
  • RHSA-2026:19410 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.9 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19409 Released 2026-05-19 · Red Hat rating Important
    MTV RHEL9 Images
    • Migration Toolkit for Virtualization 2.10 registry.redhat.io/migration-toolkit-virtualization/mtv-console-plugin-rhel9
  • RHSA-2026:19167 Released 2026-05-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.11-2.el9_8.1, pcs-snmp-0.11.11-2.el9_8.1
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.11-2.el9_8.1, pcs-snmp-0.11.11-2.el9_8.1
  • RHSA-2026:19008 Released 2026-05-19 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.2-3.el10_2.1, pcs-0.12.2-3.el10_2.1, pcs-snmp-0.12.2-3.el10_2.1
  • RHSA-2026:17550 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.24 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.17 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:17549 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.16 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/mcg-core-rhel9, registry.redhat.io/odf4/mcg-rhel9-operator +15
  • RHSA-2026:17547 Released 2026-05-14 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.20 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:16874 Released 2026-05-13 · Red Hat rating Important
    Network Observability 1.11.2 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +1
  • RHSA-2026:14871 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:14870 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:13826 Released 2026-05-05 · Red Hat rating Critical
    Red Hat Developer Hub 1.9.4 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:13571 Released 2026-05-04 · Red Hat rating Critical
    Streams for Apache Kafka 3.2.0 release and security update
    • Streams for Apache Kafka 3.2.0
  • RHSA-2026:13553 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
  • RHSA-2026:13545 Released 2026-05-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/ansible-dev-tools-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/eda-controller-rhel9 +11
  • RHSA-2026:12279 Released 2026-04-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.15 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:12277 Released 2026-04-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.10 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:11516 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.7, pcs-snmp-0.11.7-2.el9_4.7
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.7, pcs-snmp-0.11.7-2.el9_4.7
  • RHSA-2026:11493 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.11, pcs-snmp-0.10.8-1.el8_4.11
  • RHSA-2026:11469 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) pcs-0.11.4-7.el9_2.8, pcs-snmp-0.11.4-7.el9_2.8
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) pcs-0.11.4-7.el9_2.8, pcs-snmp-0.11.4-7.el9_2.8
  • RHSA-2026:11495 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.11, pcs-snmp-0.10.15-4.el8_8.11
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.11, pcs-snmp-0.10.15-4.el8_8.11
  • RHSA-2026:11494 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.13, pcs-snmp-0.10.12-6.el8_6.13
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.13, pcs-snmp-0.10.12-6.el8_6.13
  • RHSA-2026:11471 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.6) pcs-0.11.9-2.el9_6.4, pcs-snmp-0.11.9-2.el9_6.4
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.6) pcs-0.11.9-2.el9_6.4, pcs-snmp-0.11.9-2.el9_6.4
  • RHSA-2026:11470 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v. 10.0) cockpit-ha-cluster-0.12.0-3.el10_0.5, pcs-0.12.0-3.el10_0.5, pcs-snmp-0.12.0-3.el10_0.5
  • RHSA-2026:11454 Released 2026-04-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.11, pcs-snmp-0.11.1-10.el9_0.11
  • RHSA-2026:10713 Released 2026-04-27 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.1-1.el10_1.3, pcs-0.12.1-1.el10_1.3, pcs-snmp-0.12.1-1.el10_1.3
  • RHSA-2026:10710 Released 2026-04-27 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.10-1.el9_7.3, pcs-snmp-0.11.10-1.el9_7.3
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.10-1.el9_7.3, pcs-snmp-0.11.10-1.el9_7.3
  • RHSA-2026:10175 Released 2026-04-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.27.1 Release.
    • Red Hat OpenShift Dev Spaces 3.27 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/devspaces-rhel9-operator +8
  • RHSA-2026:10131 Released 2026-04-23 · Red Hat rating Important
    RHTAS 1.3.4 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6
  • RHSA-2026:9742 Released 2026-04-22 · Red Hat rating Critical
    Red Hat Developer Hub 1.8.6 release.
    • Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:9385 Released 2026-04-21 · Red Hat rating Important
    Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release
    • Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9 +2
  • RHSA-2026:8498 Released 2026-04-16 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:8493 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.22.2 for Red Hat OpenShift Service Mesh 3.3
    • Red Hat OpenShift Service Mesh 3.3 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8491 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.17.6 for Red Hat OpenShift Service Mesh 3.2
    • Red Hat OpenShift Service Mesh 3.2 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8490 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.11.9 for Red Hat OpenShift Service Mesh 3.1
    • Red Hat OpenShift Service Mesh 3.1 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8484 Released 2026-04-16 · Red Hat rating Critical
    Kiali 2.4.15 for Red Hat OpenShift Service Mesh 3.0
    • Red Hat OpenShift Service Mesh 3.0 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel9, registry.redhat.io/openshift-service-mesh/kiali-rhel9
  • RHSA-2026:8483 Released 2026-04-16 · Red Hat rating Critical
    Kiali 1.73.29 for Red Hat OpenShift Service Mesh 2.6
    • Red Hat OpenShift Service Mesh 2.6 registry.redhat.io/openshift-service-mesh/kiali-ossmc-rhel8, registry.redhat.io/openshift-service-mesh/kiali-rhel8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    lodash, lodash-amd, lodash-es 4.18.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-02542 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`Priority LOW 35
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Cryostat 4AffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Migration Toolkit for Applications 8AffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix planned: Will not fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat Discovery 2AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Self-service automation portal 2AffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:34342
Cryostat 4 on RHEL 9Fixed RHSA-2026:17789
Migration Toolkit for Virtualization 2.10Fixed RHSA-2026:19409
Migration Toolkit for Virtualization 2.9Fixed RHSA-2026:19410
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:16874
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:13553
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:42078
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:13545
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:24762
Red Hat Data Grid 8.6.1Fixed RHSA-2026:22619
Red Hat Developer Hub 1.8Fixed RHSA-2026:9742
Red Hat Developer Hub 1.9Fixed RHSA-2026:13826
Red Hat Edge Manager 1.0Fixed RHSA-2026:36651
Red Hat Edge Manager 1.1Fixed RHSA-2026:40118, RHSA-2026:40945
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:24331
Red Hat Enterprise Linux AppStream (v. 9)Fixed—
Red Hat Enterprise Linux BaseOS (v. 10)Fixed—
Red Hat Enterprise Linux BaseOS (v. 9)Fixed—
Red Hat Enterprise Linux High Availability (v. 10)Fixed RHSA-2026:10713, RHSA-2026:19008
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2026:10710, RHSA-2026:19167
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:11493
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:11494
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:11495
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:11454
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:11469
Red Hat Enterprise Linux High Availability EUS (v. 10.0)Fixed RHSA-2026:11470
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:11516
Red Hat Enterprise Linux High Availability EUS (v.9.6)Fixed RHSA-2026:11471
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:11494
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:11495
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:11493
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2026:10710, RHSA-2026:19167
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:11469
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:11516
Red Hat Enterprise Linux Resilient Storage EUS (v.9.6)Fixed RHSA-2026:11471
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:11454
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:24977
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:59833
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:54188
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:56789
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:56912
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:36621, RHSA-2026:56854
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:17598, RHSA-2026:34100, RHSA-2026:60023
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:17448, RHSA-2026:21658, RHSA-2026:48699
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:20041, RHSA-2026:20042, RHSA-2026:44235
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:17468, RHSA-2026:17469, RHSA-2026:40795
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:37186
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:29795
Red Hat OpenShift Dev Spaces 3.27Fixed RHSA-2026:10175
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:68754
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:20946
Red Hat OpenShift GitOps 1.19Fixed RHSA-2026:20943
Red Hat OpenShift Service Mesh 2.6Fixed RHSA-2026:8483
Red Hat OpenShift Service Mesh 3.0Fixed RHSA-2026:8484
Red Hat OpenShift Service Mesh 3.1Fixed RHSA-2026:8490
Red Hat OpenShift Service Mesh 3.2Fixed RHSA-2026:8491
Red Hat OpenShift Service Mesh 3.3Fixed RHSA-2026:8493
Red Hat OpenShift distributed tracing 3.9.3Fixed RHSA-2026:9385
Red Hat Openshift Data Foundation 4.16Fixed RHSA-2026:17549, RHSA-2026:83619
Red Hat Openshift Data Foundation 4.17Fixed RHSA-2026:17550, RHSA-2026:83622
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:17547, RHSA-2026:41941
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:12279, RHSA-2026:41944
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:12277, RHSA-2026:40984
Red Hat Satellite 6.18Fixed RHSA-2026:14870, RHSA-2026:14871, RHSA-2026:8498
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:10131
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:83598
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.0Fixed RHSA-2026:13571
Not affected: 65 products
  • Cluster Observability Operator 1.5
  • Cryostat 4 on RHEL 9
  • Gatekeeper 3
  • Migration Toolkit for Virtualization 2.10
  • Migration Toolkit for Virtualization 2.9
  • Multicluster Engine for Kubernetes
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.8
  • Red Hat Developer Hub 1.9
  • Red Hat Directory Server 11
  • Red Hat Directory Server 12
  • Red Hat Directory Server 13
  • Red Hat Edge Manager 1.0
  • Red Hat Edge Manager 1.1
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Dev Spaces 3.27
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenShift GitOps 1.19
  • Red Hat OpenShift Service Mesh 3.3
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 3.9.3
  • Red Hat Openshift Data Foundation 4.16
  • Red Hat Openshift Data Foundation 4.17
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Trusted Artifact Signer
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat Trusted Profile Analyzer

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4800
  2. 2026-10-03 Alias added: GHSA-r5fr-rjxr-66jc
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-15 Fix available: lodash/[email protected], lodash/[email protected], lodash/[email protected] +1 · CNA
  5. 2026-10-15 1 new reference · CNA
  6. 2026-10-16 Fix available: RHSA-2026:83619 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83622 · Red Hat
  8. 2026-10-16 Fix available: RHSA-2026:83598 · Red Hat
  9. 2026-10-16 Fix available: Migration Toolkit for Virtualization 2.10, Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Trusted Artifact Signer 1.4 · Red Hat
  10. 2026-10-27 Affected versions changed · Red Hat
  11. 2026-10-30 Affected versions changed · Red Hat
  12. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Advisory 3

Other 3

  • TI-2021-06035 Command injection in Lodash CVSS 3.1HIGH 7.2
  • TI-2019-08009 Prototype pollution in Snyk lodash CVSS 3.1CRITICAL 9.1
  • TI-2020-06621 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. CVSS 3.1HIGH 7.4
  • TI-2025-12309 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions CVSS 4.0MEDIUM 6.9
  • TI-2020-17303 Regular expression denial of service (ReDoS) in Lodash CVSS 3.1MEDIUM 5.3
  • TI-2026-02542 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences