Skip to content
OpenAdvisories
High ALSA-2026:10710 1 CVE

Important: pcs security update

Published Apr 27, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 pcs 0.11.10-1.el9_7.3
AlmaLinux · 9 pcs-snmp 0.11.10-1.el9_7.3

Vulnerabilities 1

  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-4800
  • report
    https://bugzilla.redhat.com/2453496
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-10710.html