critique
CVE-2026-29063
immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (élevée).
Description
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | arangodb-3.11, arangodb-3.12, argo-workflows-3.6 et 19 autres | 3.11.14.5-r13 et 21 autres |
| debian 11 | node-immutable | pas de correctif indiqué |
| debian 12 | node-immutable | pas de correctif indiqué |
| debian 13 | node-immutable | pas de correctif indiqué |
| debian 14 | node-immutable | 4.3.8-1 |
| echo | node-immutable | pas de correctif indiqué |
| echo npm::Echo OSV | immutable | 3.7.6+echo.1 |
| minimos | argo-workflows-3.7, argo-workflows-fips-3.7 | 3.7.10-r4 et 1 autres |
| npm::GitHub Security Advisory npm | immutable | 4.3.8, 5.1.5, 3.8.3 |
| rapidfort alma 10 | grafana, grafana-selinux | pas de correctif indiqué |
| rapidfort alma 9 | gjs, grafana, grafana-selinux | pas de correctif indiqué |
| rapidfort debian 12 | node-immutable | 0:4.3.8-1 |
Afficher les 72 entrées de 22 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| chainguard | arangodb-3.11 | 3.11.14.5-r13 |
| chainguard | arangodb-3.12 | 3.12.9.4-r26 |
| chainguard | argo-workflows-3.6 | 3.6.19-r3 |
| chainguard | argo-workflows-3.7 | 3.7.10-r4 |
| chainguard | argo-workflows-4.0 | 4.0.1-r4 |
| chainguard | authentik-2026.2 | 2026.2.5-r4 |
| chainguard | authentik-fips-2026.2 | 2026.2.4-r11 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | rancher-api-ui | 1.2.3-r6 |
| chainguard | vitess-22 | 22.0.4-r6 |
| chainguard | vitess-23 | 23.0.3-r7 |
| debian 11 | node-immutable | pas de correctif indiqué |
| debian 12 | node-immutable | pas de correctif indiqué |
| debian 13 | node-immutable | pas de correctif indiqué |
| debian 14 | node-immutable | 4.3.8-1 |
| echo | node-immutable | pas de correctif indiqué |
| echo npm::Echo OSV | immutable | 3.7.6+echo.1 |
| minimos | argo-workflows-3.7 | 3.7.10-r4 |
| minimos | argo-workflows-fips-3.7 | 3.7.10-r5 |
| npm::GitHub Security Advisory npm | immutable | 4.3.8, 5.1.5, 3.8.3 |
| rapidfort alma 10 | grafana | pas de correctif indiqué |
| rapidfort alma 10 | grafana-selinux | pas de correctif indiqué |
| rapidfort alma 9 | gjs | pas de correctif indiqué |
| rapidfort alma 9 | grafana | pas de correctif indiqué |
| rapidfort alma 9 | grafana-selinux | pas de correctif indiqué |
| rapidfort debian 12 | node-immutable | 0:4.3.8-1 |
| rapidfort debian 13 | node-immutable | 0:4.3.8-1 |
| rapidfort fedora 43 | grafana | 10.2.6-23.fc43 |
| rapidfort fedora 43 | grafana-selinux | 10.2.6-23.fc43 |
| rapidfort Oracle Linux 10 | grafana | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | grafana-selinux | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | gjs | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | grafana | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | grafana-selinux | pas de correctif indiqué |
| rapidfort Red Hat 10 | grafana | pas de correctif indiqué |
| rapidfort Red Hat 10 | grafana-selinux | pas de correctif indiqué |
| rapidfort Red Hat 9 | grafana | pas de correctif indiqué |
| rapidfort Red Hat 9 | grafana-selinux | pas de correctif indiqué |
| rapidfort rocky 10 | grafana | pas de correctif indiqué |
| rapidfort rocky 10 | grafana-selinux | pas de correctif indiqué |
| rapidfort rocky 9 | gjs | pas de correctif indiqué |
| rapidfort rocky 9 | grafana | pas de correctif indiqué |
| rapidfort rocky 9 | grafana-selinux | pas de correctif indiqué |
| Red Hat | gjs | pas de correctif indiqué |
| Red Hat | gjs-devel | pas de correctif indiqué |
| Red Hat | grafana | pas de correctif indiqué |
| Red Hat | grafana-selinux | pas de correctif indiqué |
| Red Hat | nodejs-connected-react-router | pas de correctif indiqué |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | pas de correctif indiqué |
| Red Hat | openshift-service-mesh/kiali-rhel8 | pas de correctif indiqué |
| Red Hat | openshift4/nmstate-console-plugin-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-console | pas de correctif indiqué |
| Red Hat | openshift4/ose-console-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-monitoring-plugin-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-networking-console-plugin-rhel9 | pas de correctif indiqué |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | pas de correctif indiqué |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | pas de correctif indiqué |
| wolfi | argo-workflows-4.0 | 4.0.1-r4 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | rancher-api-ui | 1.2.3-r6 |
| wolfi | vitess-23 | 23.0.3-r7 |
Références
- https://access.redhat.com/errata/RHSA-2026:11070
- https://access.redhat.com/errata/RHSA-2026:11217
- https://access.redhat.com/errata/RHSA-2026:11414
- https://access.redhat.com/errata/RHSA-2026:11858
- https://access.redhat.com/errata/RHSA-2026:11916
- https://access.redhat.com/errata/RHSA-2026:12118
- https://access.redhat.com/errata/RHSA-2026:13542
- https://access.redhat.com/errata/RHSA-2026:13548
Les 81 références
- https://access.redhat.com/errata/RHSA-2026:13791
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:13829
- https://access.redhat.com/errata/RHSA-2026:13847
- https://access.redhat.com/errata/RHSA-2026:13853
- https://access.redhat.com/errata/RHSA-2026:17469
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20034
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:20042
- https://access.redhat.com/errata/RHSA-2026:20088
- https://access.redhat.com/errata/RHSA-2026:21657
- https://access.redhat.com/errata/RHSA-2026:21658
- https://access.redhat.com/errata/RHSA-2026:21703
- https://access.redhat.com/errata/RHSA-2026:21931
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:23246
- https://access.redhat.com/errata/RHSA-2026:24473
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:26225
- https://access.redhat.com/errata/RHSA-2026:26232
- https://access.redhat.com/errata/RHSA-2026:27063
- https://access.redhat.com/errata/RHSA-2026:28893
- https://access.redhat.com/errata/RHSA-2026:28964
- https://access.redhat.com/errata/RHSA-2026:29857
- https://access.redhat.com/errata/RHSA-2026:29864
- https://access.redhat.com/errata/RHSA-2026:34049
- https://access.redhat.com/errata/RHSA-2026:34099
- https://access.redhat.com/errata/RHSA-2026:34100
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:36621
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:40022
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:6428
- https://access.redhat.com/errata/RHSA-2026:6568
- https://access.redhat.com/errata/RHSA-2026:6720
- https://access.redhat.com/errata/RHSA-2026:6926
- https://access.redhat.com/errata/RHSA-2026:7329
- https://access.redhat.com/errata/RHSA-2026:8218
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/errata/RHSA-2026:9848
- https://access.redhat.com/security/cve/CVE-2026-29063
- https://advisory.echohq.com/cve/CVE-2026-29063
- https://bugzilla.redhat.com/show_bug.cgi?id=2445291
- https://github.com/advisories/GHSA-wf6x-7x77-mvgw
- https://github.com/immutable-js/immutable-js
- https://github.com/immutable-js/immutable-js/commit/16b3313fdf2c5f579f10799e22869f6909abf945
- https://github.com/immutable-js/immutable-js/commit/6e2cf1cfe6137e72dfa48fc2cfa8f4d399d113f9
- https://github.com/immutable-js/immutable-js/commit/6ed4eb626906df788b08019061b292b90bc718cb
- https://github.com/immutable-js/immutable-js/issues/2178
- https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3
- https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8
- https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5
- https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw
- https://nvd.nist.gov/vuln/detail/CVE-2026-29063
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29063.json
- https://www.cve.org/CVERecord?id=CVE-2026-29063