VDB
RHSA-2026:68754
RHSA-2026:68754
PUBLISHED
CVSS 3.700000047683716 LOW
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Risk Scores
CVSS 3.1
3.700000047683716
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:2b95aea3e7e825f9d48b8a8b3bbe0cdb7f51ac9c8e402b549f32a89c0a85ebb8_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/oauth2-proxy-rhel9@sha256:c62b99a6c35cea9360ab9994bac243a5767fcd0ae64f0d88751365148bec7bf1_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/configbump-rhel9@sha256:ed9b4c7ab59b471037aff0f7ed28a7034c106afdc8499e9f93095a811afa9f26_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/configbump-rhel9@sha256:89945e1e7002f32baf24f667253d21c1afdc5d26831d820f544247ee7ba539d9_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/imagepuller-rhel9@sha256:d9cab0bbd23f837a9a478f56629556bc6487666b79e241963fa6a616523ebd46_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/code-sshd-rhel9@sha256:72f9aefc6cffaadc656bf4cebb6111bb719a97c519b6a613908d16f90d355ce2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/dashboard-rhel9@sha256:66086271381e4fd5f6f156458ef6ddcb15e3ba6d0379530768b11e6ea6b8ae11_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:cede94c3433ba897c9567d804301f3165779e84d25d61d009076a8679002701b_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/server-rhel9@sha256:6cd1ad9a770a68e8d2e9688109699c0f0a259f5b0f90f30cc572b2df30dfd110_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4775c3a67b5e7676f9aa46327f07008237ea6e7406e345e3edd402472a02c0a1_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/server-rhel9@sha256:82b21ae065cd72a3c2b13199e89d1a62b07a151252a8349344503ae6b6c6758a_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/imagepuller-rhel9@sha256:ddd590ba06d1a2bdae507a463c0022b07e83ff552b0f86cf3ebc78bbfd32b7fe_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:1112fdd0f88e9f42de6dd99366c252c842590f1a8a1c32715e6e5d80b311c6f2_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/dashboard-rhel9@sha256:6722afd90301e2367b5d360337321856a03b9b7427a91ac4d487fc7c235ec992_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/code-sshd-rhel9@sha256:e8c47fe983e7921de3ab242bbfee585906f2e067e1d1be7b053919dee6316fd4_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:0305cb4f3441510811f3db3fa33097e189aeccfc2256f240c4090862cf834ca5_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/code-rhel9@sha256:23f78b2564f05173a9d5beb28d85369c6d2c095b479d4d11f3a8f1aae0844f04_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/udi-base-rhel9@sha256:b6a8fb28f6a69eac6b3b55ada9533bdbd0fde08450ebc59c3475d69471ac617d_s390x as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/openvsx-rhel9@sha256:fdfa0647b4f5e98e2aeef597c375c9f5217f8699c27c297ce92d247798be2fd7_arm64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
| Red Hat | registry.redhat.io/devspaces/openvsx-rhel9@sha256:fa65ed94629e2037de34fa2ad1aaafe03b82208a6624cba5d449e5d888d014a2_amd64 as a component of Red Hat OpenShift Dev Spaces 3.30 | * |
…and 37 more
Timeline
- Sep 17, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Distribution Patch
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
- Oct 14, 2026 Security Advisory
References
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm advisory
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c advisory
- https://access.redhat.com/errata/RHSA-2026:68754 advisory
- https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.30/html/administration_guide/installing-devspaces advisory
- https://access.redhat.com/security/cve/CVE-2026-45623 advisory
- https://access.redhat.com/security/cve/CVE-2026-45819 advisory
- https://access.redhat.com/security/cve/CVE-2026-47219 advisory
- https://access.redhat.com/security/cve/CVE-2026-4800 advisory
- https://access.redhat.com/security/cve/CVE-2026-48801 advisory
- https://access.redhat.com/security/cve/CVE-2026-54272 advisory
- https://access.redhat.com/security/cve/CVE-2026-55831 advisory
- https://access.redhat.com/security/cve/CVE-2026-55833 advisory
- https://access.redhat.com/security/cve/CVE-2026-56745 advisory
- https://access.redhat.com/security/cve/CVE-2026-56746 advisory
- https://access.redhat.com/security/cve/CVE-2026-56819 advisory
- https://access.redhat.com/security/cve/CVE-2026-59887 advisory
- https://access.redhat.com/security/cve/CVE-2026-59899 advisory
- https://access.redhat.com/security/cve/CVE-2026-67213 advisory
- https://access.redhat.com/security/cve/CVE-2026-67312 advisory
- https://access.redhat.com/security/cve/CVE-2026-67313 advisory
…and 219 more