Skip to content
OpenAdvisories
Critical RHSA-2026:39058 2 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Jul 16, 2026 · Updated Sep 8, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 prometheus3.13 0:3.13.1-0.1.hum1

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-47429 Public exploit

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API wri…

    vitest-dev vitest vitess-23 vitest Wolfi npm
  • Critical 9.6
    CVE-2026-47428

    Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

    Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to…

    vitest-dev vitest @vitest/browser npm

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-47428
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-47429
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39058.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500578
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-47428
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-47428
  • article
    https://github.com/vitest-dev/vitest/commit/18af98cee1830604d57f6a02bf28f8067cdffc06
  • article
    https://github.com/vitest-dev/vitest/commit/3514f9fa135c90e1c35754fc4d27c9cf351faafa
  • article
    https://github.com/vitest-dev/vitest/pull/10283
  • article
    https://github.com/vitest-dev/vitest/pull/10285
  • article
    https://github.com/vitest-dev/vitest/releases/tag/v4.1.6
  • article
    https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-beta.3
  • article
    https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2500573
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-47429
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-47429
  • article
    https://github.com/vitest-dev/vitest/commit/20e00ef7808de6d330c5e2fda530f686e08f1c8d
  • article
    https://github.com/vitest-dev/vitest/commit/af88b1f5d82844a4761ea9a977156c98e2b14ca8
  • article
    https://github.com/vitest-dev/vitest/pull/10445
  • article
    https://github.com/vitest-dev/vitest/pull/9350
  • article
    https://github.com/vitest-dev/vitest/releases/tag/v3.2.5
  • article
    https://github.com/vitest-dev/vitest/releases/tag/v4.1.0
  • article
    https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp