Skip to content
OpenAdvisories
High ALSA-2026:2452 1 CVE

Important: pcs security update

Published Feb 10, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 pcs 0.11.10-1.el9_7.2
AlmaLinux · 9 pcs-snmp 0.11.10-1.el9_7.2

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-13465
  • report
    https://bugzilla.redhat.com/2431740
  • advisory
    https://errata.almalinux.org/9/ALSA-2026-2452.html