RHSA-2026:48699 | Vulnetix

RHSA-2026:48699 PUBLISHED CVSS 7.5 HIGH

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:481789c068fba9b6bd657a2e193b33d6c4fb5c6cff0d0f63a7e55986e56d0eba_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:14580d43056d87cf84a2ce5f2fc7fa5ad3dd47745e53f431bff1203db20a7b77_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-ironic-rhel9@sha256:683cd49dfc9a43c876db6cf94b9f7e417cee3f7bc0adbd320aa0cb924b817732_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:0c0289461e7dc8ace658fee1c39f97e7718f563d903e103436da4359f8570b65_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:749150b69ff000b5f45a5c169ef58c2c67541f1f5caba7539a2e8e133abb122c_arm64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:33578de6f34f30567f0b7d3b5cda88e441026c02fa3a404876672fe586313f73_ppc64le as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-ironic-machine-os-downloader-rhel9@sha256:3df178f2cdc1b46a0fb728b1ce65689052c1728cfacadd4ad95383017a625202_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-console-rhel9@sha256:417a162d360d2da6bb1aec58f44a3400482fcaa9c535929e62676c1834524ead_arm64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:303de185a374a7d3a22eec6d10e1c8a178f68a33d0573b195fa8d9b40d67becc_ppc64le as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-console-rhel9@sha256:44230e060120cd247e24f22e21b03423ac13b4f41f6eb081172f9be06f25c584_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-prometheus-rhel9@sha256:1dcaf6f017f0cf1d06f5626490fec03a29101f94ff4e88e487a81c6c403b5533_ppc64le as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/driver-toolkit-rhel9@sha256:0866eb3d44068199d2511abb8d1ca782dd61dd66b13a6d0b72dbc727c2331ded_s390x as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-console-rhel9@sha256:f18eef7c2dd973425a667f993bd8c3ed5b06acf098276d56d4840da210b11b2e_s390x as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:4ae0174eec7cff35f2ae0926d28975ad4d2f303c4c3259fc5e2b9deea91699ad_amd64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9@sha256:32455bd12de20c48a129c30001ee8dadb6583182df7797ee6ace06e3a4a09547_arm64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:57686feccedbbb655b36d5231aa69f47b0d77ff9c04203bb78218feb0367585e_s390x as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:d5e995a9e67601d5caca85a6279393e8a7535d06071c1cb8892c85f1ec9c6c7a_arm64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-hypershift-rhel9@sha256:cdea7b9a3878b0f1b087fc19587e91f6c35a1325e09efe411985f35c7af7a3d4_arm64 as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:a9df2055d0d970ba40f5b2ed3cbf8a8418b60090fed5858a6cbce116e70917ae_s390x as a component of Red Hat OpenShift Container Platform 4.18	, , *
Red Hat	registry.redhat.io/openshift4/ose-console-rhel9@sha256:68d192c8b0b1fe78c82e9640cb734ac14b2321a8c710f88ac06bb87892fb2313_ppc64le as a component of Red Hat OpenShift Container Platform 4.18	, , *

…and 21 more

Timeline

Aug 5, 2026 CVE Published
Sep 9, 2026 CVE Updated
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Distribution Patch
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory
Sep 9, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:48699 advisory
https://access.redhat.com/security/cve/CVE-2026-16242 advisory
https://access.redhat.com/security/cve/CVE-2026-33186 advisory
https://access.redhat.com/security/cve/CVE-2026-40895 advisory
https://access.redhat.com/security/cve/CVE-2026-42154 advisory
https://access.redhat.com/security/cve/CVE-2026-4800 advisory
https://access.redhat.com/security/cve/CVE-2026-9277 advisory
https://access.redhat.com/security/updates/classification/ advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48699.json advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2453496 issue
https://www.cve.org/CVERecord?id=CVE-2026-4800 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-4800 advisory
https://cna.openjsf.org/security-advisories.html advisory
https://github.com/advisories/GHSA-35jh-r3h4-6jhm advisory
https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2480741 issue
https://www.cve.org/CVERecord?id=CVE-2026-9277 advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-9277 advisory
https://github.com/ljharb/shell-quote advisory
https://github.com/ljharb/shell-quote/commit/1518179 advisory

…and 22 more

Open in Interactive Console →