Skip to content
OpenAdvisories
High RHSA-2026:24331 2 CVEs

Red Hat Security Advisory: cockpit-image-builder security update

Published Jun 8, 2026 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.2 cockpit-image-builder 0:94.3-1.el10_2

Vulnerabilities 2

  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431740
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2453496
  • article
    https://issues.redhat.com/browse/RHEL-182455
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24331.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-13465
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-13465
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-13465
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
  • report
    https://access.redhat.com/security/cve/CVE-2026-4800
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-4800
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-4800
  • article
    https://cna.openjsf.org/security-advisories.html
  • article
    https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc