Skip to content
OpenAdvisories
High RLSA-2026:2452 1 CVE

Important: pcs security update

Published Feb 13, 2026 · Updated Feb 13, 2026

Ecosystem: Rocky Linux

Summary

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 pcs 0:0.11.10-1.el9_7.2

Vulnerabilities 1

  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2431740