VDB
RHSA-2026%3A13853
RHSA-2026%3A13853
PUBLISHED
CVSS 8.800000190734863 HIGH
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:9f182cfaf66713b47164a190926e1ed3c195f03f706fcdc90b1b0dfb7b0f4cc9_amd64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:9f182cfaf66713b47164a190926e1ed3c195f03f706fcdc90b1b0dfb7b0f4cc9_amd64, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:478f98eecc5abeaa7a0a7231f235cdfe3198caf5ef3e1dbaf528b50dfb019740_s390x as a component of multicluster engine for Kubernetes 2.11 | *, *, registry.redhat.io/multicluster-engine/backplane-rhel9-operator@sha256:478f98eecc5abeaa7a0a7231f235cdfe3198caf5ef3e1dbaf528b50dfb019740_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:c89f4391a0900bbf7600a2225dbed13a5069f6bf668441286615b0951ccefc58_arm64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:c89f4391a0900bbf7600a2225dbed13a5069f6bf668441286615b0951ccefc58_arm64, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator@sha256:c89f4391a0900bbf7600a2225dbed13a5069f6bf668441286615b0951ccefc58_arm64, * |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:b42a53396e24acd2c0a354298a99abfc52627587980f4f9886eb1475a08272b4_amd64 as a component of multicluster engine for Kubernetes 2.11 | *, *, registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:b42a53396e24acd2c0a354298a99abfc52627587980f4f9886eb1475a08272b4_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:76f6507733d2be362fae0a54bea723e8d11a0880f96e3e4109e962192b3e4b0d_s390x as a component of multicluster engine for Kubernetes 2.11 | *, *, registry.redhat.io/multicluster-engine/hypershift-cli-rhel9@sha256:76f6507733d2be362fae0a54bea723e8d11a0880f96e3e4109e962192b3e4b0d_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:729a9f0a8393b02e3813466a227c57a9862165c398a5705df44e459fc4d0dafb_ppc64le as a component of multicluster engine for Kubernetes 2.11 | *, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:729a9f0a8393b02e3813466a227c57a9862165c398a5705df44e459fc4d0dafb_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:acdce8fdb6fb63e7b7b38df61732c7fe3d8969d4f47eb918cb4f292d398f6656_arm64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:acdce8fdb6fb63e7b7b38df61732c7fe3d8969d4f47eb918cb4f292d398f6656_arm64, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:bbc2ec605b277977b5a243aa8bdf3e061c303487c26b223edfe8a41e93dab0aa_s390x as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:bbc2ec605b277977b5a243aa8bdf3e061c303487c26b223edfe8a41e93dab0aa_s390x, registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:bbc2ec605b277977b5a243aa8bdf3e061c303487c26b223edfe8a41e93dab0aa_s390x, registry.redhat.io/multicluster-engine/image-based-install-rhel9@sha256:bbc2ec605b277977b5a243aa8bdf3e061c303487c26b223edfe8a41e93dab0aa_s390x |
| Red Hat | registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:ee9b206f323b5eaab9e2521642866823ee56ae93c940043337f7f9a4853c795b_s390x as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:ee9b206f323b5eaab9e2521642866823ee56ae93c940043337f7f9a4853c795b_s390x, registry.redhat.io/multicluster-engine/addon-manager-rhel9@sha256:ee9b206f323b5eaab9e2521642866823ee56ae93c940043337f7f9a4853c795b_s390x, * |
| Red Hat | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c084c3cbabb9d694337805914882e485e20e4f5e09c3b52459a99206f9e2dc04_arm64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c084c3cbabb9d694337805914882e485e20e4f5e09c3b52459a99206f9e2dc04_arm64, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c084c3cbabb9d694337805914882e485e20e4f5e09c3b52459a99206f9e2dc04_arm64, registry.redhat.io/multicluster-engine/kube-rbac-proxy-mce-rhel9@sha256:c084c3cbabb9d694337805914882e485e20e4f5e09c3b52459a99206f9e2dc04_arm64 |
| Red Hat | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5a07389481681681ac4433530a5eaaacb12b47c2bc4faedc1feecc41a719357e_arm64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5a07389481681681ac4433530a5eaaacb12b47c2bc4faedc1feecc41a719357e_arm64, registry.redhat.io/multicluster-engine/registration-rhel9@sha256:5a07389481681681ac4433530a5eaaacb12b47c2bc4faedc1feecc41a719357e_arm64, * |
| Red Hat | registry.redhat.io/multicluster-engine/hive-rhel9@sha256:50659b837eb60d89434082cd4628eab62e2f1c8cb6ff6ab98d82753a0b19b07c_ppc64le as a component of multicluster engine for Kubernetes 2.11 | *, registry.redhat.io/multicluster-engine/hive-rhel9@sha256:50659b837eb60d89434082cd4628eab62e2f1c8cb6ff6ab98d82753a0b19b07c_ppc64le, registry.redhat.io/multicluster-engine/hive-rhel9@sha256:50659b837eb60d89434082cd4628eab62e2f1c8cb6ff6ab98d82753a0b19b07c_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:f056e1b4865f37b83d0efad6848f04c75f3df85dae73dfbf44acc999e342cfe1_amd64 as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:f056e1b4865f37b83d0efad6848f04c75f3df85dae73dfbf44acc999e342cfe1_amd64, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:f056e1b4865f37b83d0efad6848f04c75f3df85dae73dfbf44acc999e342cfe1_amd64, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9@sha256:f056e1b4865f37b83d0efad6848f04c75f3df85dae73dfbf44acc999e342cfe1_amd64 |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d58c077d4bd1d433b92aada8f9ea2b4f25c063fa4b306fa91cf033adda8e7742_ppc64le as a component of multicluster engine for Kubernetes 2.11 | *, registry.redhat.io/multicluster-engine/cluster-api-provider-agent-rhel9@sha256:d58c077d4bd1d433b92aada8f9ea2b4f25c063fa4b306fa91cf033adda8e7742_ppc64le, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9ff764e0485738ca468fb7f45d61afdb4ef9cba6f0b4cd7ec41a2a3711d48cba_ppc64le as a component of multicluster engine for Kubernetes 2.11 | *, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9ff764e0485738ca468fb7f45d61afdb4ef9cba6f0b4cd7ec41a2a3711d48cba_ppc64le, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9@sha256:9ff764e0485738ca468fb7f45d61afdb4ef9cba6f0b4cd7ec41a2a3711d48cba_ppc64le |
| Red Hat | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3221c749e5e2615975b78f3bbe22e515244debde5ba5894aa787132f8479a4a9_s390x as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3221c749e5e2615975b78f3bbe22e515244debde5ba5894aa787132f8479a4a9_s390x, registry.redhat.io/multicluster-engine/must-gather-rhel9@sha256:3221c749e5e2615975b78f3bbe22e515244debde5ba5894aa787132f8479a4a9_s390x, * |
| Red Hat | registry.redhat.io/multicluster-engine/mce-capi-webhook-config-rhel9@sha256:14391748a46cbbc212da96b6de057a5479f4777e33aac9c58d756583e0809a07_amd64 as a component of multicluster engine for Kubernetes 2.11 | *, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9@sha256:2d720a8823482a9a47149b798be7f4c0b87e888dfcc648016c1467c5f6882de4_ppc64le | |
| Red Hat | registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:5e1bd11d881544a6e4c15470efa140aabf0fac8a73cc8376e594f297b602b432_s390x as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/azure-service-operator-rhel9@sha256:5e1bd11d881544a6e4c15470efa140aabf0fac8a73cc8376e594f297b602b432_s390x, *, * |
| Red Hat | registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:ca5485c2bb35759b4c982ce048a649589d64126bde11550b4b5b6d80b04a266a_s390x as a component of multicluster engine for Kubernetes 2.11 | registry.redhat.io/multicluster-engine/managedcluster-import-controller-rhel9@sha256:ca5485c2bb35759b4c982ce048a649589d64126bde11550b4b5b6d80b04a266a_s390x, *, * |
…and 110 more
Timeline
- May 5, 2026 CVE Published
- May 6, 2026 Distribution Patch
- May 6, 2026 Distribution Patch
- May 6, 2026 Security Advisory
- May 6, 2026 Security Advisory
- Jun 3, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:13853 advisory
- https://access.redhat.com/security/cve/CVE-2026-29063 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13853.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2445291 issue
- https://www.cve.org/CVERecord?id=CVE-2026-29063 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-29063 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8 advisory
- https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5 advisory
- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw advisory