VDB
RHSA-2026%3A3406
RHSA-2026%3A3406
PUBLISHED
CVSS 7.199999809265137 HIGH
A flaw was found in nodejs-underscore. Arbitrary code execution via the template function is possible, particularly when a variable property is passed as an argument as it is not sanitized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Risk Scores
CVSS 3.1
7.199999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:ca957dd041420e31be585cf8120c079163f660a448e30f67aa51f4509f52cb34_ppc64le as a component of Red Hat Ceph Storage 9 | *, *, * |
| Red Hat | registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:9679161550968a9c68111f57071dd8a128f16d25cb487c45adc799d17a8f4997_amd64 as a component of Red Hat Ceph Storage 9 | *, registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:9679161550968a9c68111f57071dd8a128f16d25cb487c45adc799d17a8f4997_amd64, registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:9679161550968a9c68111f57071dd8a128f16d25cb487c45adc799d17a8f4997_amd64 |
| Red Hat | nodejs-underscore | |
| Red Hat | registry.redhat.io/rhceph/grafana-rhel10@sha256:2c8bad4973281d8ccdc6e4473c1ff76730323d59c3a18a948afcb1b5da520fd5_arm64 as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/grafana-rhel10@sha256:2c8bad4973281d8ccdc6e4473c1ff76730323d59c3a18a948afcb1b5da520fd5_arm64, registry.redhat.io/rhceph/grafana-rhel10@sha256:2c8bad4973281d8ccdc6e4473c1ff76730323d59c3a18a948afcb1b5da520fd5_arm64, registry.redhat.io/rhceph/grafana-rhel10@sha256:2c8bad4973281d8ccdc6e4473c1ff76730323d59c3a18a948afcb1b5da520fd5_arm64 |
| Red Hat | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:d2900877ae6b3efdc8b693672b7bc6ac8d5ff95208a3a2a3ad85dcc03119ec41_amd64 as a component of Red Hat Ceph Storage 9 | *, *, registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:d2900877ae6b3efdc8b693672b7bc6ac8d5ff95208a3a2a3ad85dcc03119ec41_amd64 |
| Red Hat | registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:9679161550968a9c68111f57071dd8a128f16d25cb487c45adc799d17a8f4997_amd64 as a component of Red Hat Ceph Storage 9 | *, *, registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:9679161550968a9c68111f57071dd8a128f16d25cb487c45adc799d17a8f4997_amd64 |
| Red Hat | registry.redhat.io/rhceph/alloy-rhel10@sha256:731f7fa196ecfcbe18a567255eb024acb0a9bed40e379914f97d082286e89db6_amd64 as a component of Red Hat Ceph Storage 9 | *, registry.redhat.io/rhceph/alloy-rhel10@sha256:731f7fa196ecfcbe18a567255eb024acb0a9bed40e379914f97d082286e89db6_amd64, registry.redhat.io/rhceph/alloy-rhel10@sha256:731f7fa196ecfcbe18a567255eb024acb0a9bed40e379914f97d082286e89db6_amd64 |
| Red Hat | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64 as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64, registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64, registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64 |
| Red Hat | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64 | |
| Red Hat | registry.redhat.io/rhceph/grafana-rhel10@sha256:11f4acab7eb81b844ef593b87d6aa102ee17b1a200f4c2d057a8dc5df731bf75_s390x as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/grafana-rhel10@sha256:11f4acab7eb81b844ef593b87d6aa102ee17b1a200f4c2d057a8dc5df731bf75_s390x, registry.redhat.io/rhceph/grafana-rhel10@sha256:11f4acab7eb81b844ef593b87d6aa102ee17b1a200f4c2d057a8dc5df731bf75_s390x, * |
| Red Hat | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cac361a6c9b76b8da77c9a2a2cc147b54aebba5e4696f12fec74af7218006b8d_s390x as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cac361a6c9b76b8da77c9a2a2cc147b54aebba5e4696f12fec74af7218006b8d_s390x, *, registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cac361a6c9b76b8da77c9a2a2cc147b54aebba5e4696f12fec74af7218006b8d_s390x |
| Red Hat | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:d2900877ae6b3efdc8b693672b7bc6ac8d5ff95208a3a2a3ad85dcc03119ec41_amd64 as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:d2900877ae6b3efdc8b693672b7bc6ac8d5ff95208a3a2a3ad85dcc03119ec41_amd64, *, registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:d2900877ae6b3efdc8b693672b7bc6ac8d5ff95208a3a2a3ad85dcc03119ec41_amd64 |
| Red Hat | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a_arm64 as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a_arm64, registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a_arm64, registry.redhat.io/rhceph/rhceph-9-rhel9@sha256:53a72419a7e4f4b332b9c6759ff1c389f226e26599236bc770d367c68bba911a_arm64 |
| nodejs-underscore | ||
| Red Hat | registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:eb8e4c6e5f3ee09686374c0eb73d123990a403c50eee4bd8a1ba2e7f99e4bffd_s390x as a component of Red Hat Ceph Storage 9 | registry.redhat.io/rhceph/snmp-notifier-rhel10@sha256:eb8e4c6e5f3ee09686374c0eb73d123990a403c50eee4bd8a1ba2e7f99e4bffd_s390x, *, * |
| Red Hat | registry.redhat.io/rhceph/keepalived-rhel10@sha256:3fdd2ca33d42b8ccff8a3ce8f28d8ae2f855167f5971a3d5cd58ff3d0199f6fb_ppc64le as a component of Red Hat Ceph Storage 9 | *, *, * |
| Red Hat | Red Hat Ceph Storage 9 | |
| Red Hat | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cac361a6c9b76b8da77c9a2a2cc147b54aebba5e4696f12fec74af7218006b8d_s390x as a component of Red Hat Ceph Storage 9 | *, *, registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:cac361a6c9b76b8da77c9a2a2cc147b54aebba5e4696f12fec74af7218006b8d_s390x |
| Red Hat | registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:25e0a506c1234d96d6ef4d4524e1091bd3f7ba84a1ed30ba1ad60c78db22d005_arm64 as a component of Red Hat Ceph Storage 9 |
…and 37 more
Timeline
- Feb 26, 2026 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:3406 advisory
- https://access.redhat.com/security/cve/CVE-2019-10790 advisory
- https://access.redhat.com/security/cve/CVE-2021-23358 advisory
- https://access.redhat.com/security/cve/CVE-2024-51744 advisory
- https://access.redhat.com/security/cve/CVE-2024-55565 advisory
- https://access.redhat.com/security/cve/CVE-2025-14104 advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://access.redhat.com/security/cve/CVE-2025-26791 advisory
- https://access.redhat.com/security/cve/CVE-2025-6176 advisory
- https://access.redhat.com/security/cve/CVE-2025-66418 advisory
- https://access.redhat.com/security/cve/CVE-2025-66471 advisory
- https://access.redhat.com/security/cve/CVE-2025-7783 advisory
- https://access.redhat.com/security/cve/CVE-2026-21441 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2408762 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2419369 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2419455 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2419467 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2427726 issue
- https://docs.redhat.com/en/documentation/red_hat_ceph_storage/ advisory
…and 81 more