critique
CVE-2026-4800
lodash: lodash: Arbitrary code execution via untrusted input in template imports
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (élevée), AlmaLinux (élevée), Oracle (élevée), Rocky Linux (élevée), Ubuntu (moyenne).
Description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11, arangodb-3.12, argo-workflows-3.6 et 56 autres | 3.11.14.3-r5 et 57 autres |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5, moodle-5.0, moodle-5.1 et 3 autres | 4.5.15+e2 et 5 autres |
| echo npm::Echo OSV | lodash, lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11, arangodb-3.12, argo-workflows-3.7 et 17 autres | 3.11.14.3-r2 et 13 autres |
| npm::GitHub Security Advisory npm | lodash, lodash-amd, lodash-es et 1 autres | 4.18.0 |
| Oracle Linux 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
Afficher les 292 entrées de 38 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs | 0.11.11-2.el9_8.1 |
| alma 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11 | 3.11.14.3-r5 |
| chainguard | arangodb-3.12 | 3.12.7.2-r5 |
| chainguard | argo-workflows-3.6 | 3.6.19-r5 |
| chainguard | argo-workflows-3.7 | 3.7.13-r0 |
| chainguard | argo-workflows-4.0 | 4.0.4-r0 |
| chainguard | code-server | 4.112.0-r2 |
| chainguard | drupal-11.3 | 11.3.13-r3 |
| chainguard | foxx-cli | 2.1.1-r6 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-19.5 | 19.5.1-r0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| chainguard | jitsucom-jitsu | 2.11.0-r19 |
| chainguard | json-server | 0.17.4-r6 |
| chainguard | jupyter-base-notebook | 7.6.3-r2 |
| chainguard | kibana-8.17 | 8.17.10-r17 |
| chainguard | kibana-8.19 | 8.19.14-r2 |
| chainguard | kibana-9.0 | 9.0.8-r19 |
| chainguard | kibana-9.1 | 9.1.10-r12 |
| chainguard | kibana-9.2 | 9.2.7-r5 |
| chainguard | kibana-9.3 | 9.3.3-r4 |
| chainguard | kibana-9.4 | 9.4.2-r0 |
| chainguard | kubeflow-centraldashboard | 1.10.0-r18 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | kubeflow-pipelines | 2.16.0-r11 |
| chainguard | langfuse-2 | 2.95.12-r17 |
| chainguard | langfuse-3 | 3.164.0-r1 |
| chainguard | langfuse-fips-2 | 2.95.12-r20 |
| chainguard | langfuse-fips-3 | 3.164.0-r1 |
| chainguard | librechat | 0.8.4-r5 |
| chainguard | npm | 11.12.1-r3 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r8 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r7 |
| chainguard | opensearch-dashboards-3 | 3.5.0-r15 |
| chainguard | opensearch-dashboards-3-fips | 3.5.0-r9 |
| chainguard | pelias-api | 7.6.0-r6 |
| chainguard | prism | 5.15.6-r2 |
| chainguard | py3-captum | 0.9.0-r1 |
| chainguard | py3-jupyterlab | 4.6.1-r1 |
| chainguard | redisinsight | 3.2.0-r5 |
| chainguard | renovate | 43.104.7-r1 |
| chainguard | saf | 1.6.0-r0 |
| chainguard | semaphore | 2.18.12-r2 |
| chainguard | sqlpad | 7.5.7-r17 |
| chainguard | tensorflow-cpu-jupyter | 2.21.0-r8 |
| chainguard | tensorflow-gpu-jupyter | 0 |
| chainguard | ts-patch | 4.0.1-r3 |
| chainguard | vitess-22 | 22.0.4-r9 |
| chainguard | vitess-23 | 23.0.3-r12 |
| chainguard | wazuh-dashboard | 4.14.4-r1 |
| chainguard | wazuh-dashboard-fips | 4.14.7-r8 |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5 | 4.5.15+e2 |
| echo | moodle-5.0 | 5.0.11+e2 |
| echo | moodle-5.1 | 5.1.8+e2 |
| echo | moodle-5.2 | 5.2.4+e2 |
| echo | moodle-5.3 | 5.3.0+e2 |
| echo | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| echo npm::Echo OSV | lodash | 4.17.21+echo.1 |
| echo npm::Echo OSV | lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11 | 3.11.14.3-r2 |
| minimos | arangodb-3.12 | 3.12.7.1-r1 |
| minimos | argo-workflows-3.7 | 3.7.13-r0 |
| minimos | argo-workflows-fips-3.7 | 3.7.13-r0 |
| minimos | cube-1.7 | 1.7.43-r0 |
| minimos | foxx-cli | 2.1.1-r1 |
| minimos | kibana-8.19 | 8.19.16-r0 |
| minimos | kibana-9.3 | 9.3.5-r0 |
| minimos | kibana-9.4 | 9.4.2-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | nginx-proxy-manager-2 | 2.14.0-r1 |
| minimos | openclaw | 2026.4.2-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-2-plugin-alerting-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-anomaly-detection-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-flow-framework | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-observability | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-security-analytics-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | verdaccio | 6.8.0-r0 |
| npm::GitHub Security Advisory npm | lodash | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-amd | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-es | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash.template | 4.18.0 |
| Oracle Linux 9 | pcs | 0.11.11-2.el9_8.1 |
| Oracle Linux 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| rapidfort alma 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-files | pas de correctif indiqué |
| rapidfort alma 10 | cockpit-image-builder | 0:94.3-1.el10_2 |
| rapidfort alma 10 | cockpit-machines | pas de correctif indiqué |
| rapidfort alma 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-podman | pas de correctif indiqué |
| rapidfort alma 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort alma 10 | librados-devel | pas de correctif indiqué |
| rapidfort alma 10 | librados2 | pas de correctif indiqué |
| rapidfort alma 10 | libradospp-devel | pas de correctif indiqué |
| rapidfort alma 10 | librbd-devel | pas de correctif indiqué |
| rapidfort alma 10 | librbd1 | pas de correctif indiqué |
| rapidfort alma 8 | cockpit | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-bridge | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-doc | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-machines | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-packagekit | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-storaged | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-system | pas de correctif indiqué |
| rapidfort alma 8 | cockpit-ws | pas de correctif indiqué |
| rapidfort alma 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-files | pas de correctif indiqué |
| rapidfort alma 9 | cockpit-machines | pas de correctif indiqué |
| rapidfort alma 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-podman | pas de correctif indiqué |
| rapidfort alma 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort alma 9 | librados-devel | pas de correctif indiqué |
| rapidfort alma 9 | librados2 | pas de correctif indiqué |
| rapidfort alma 9 | libradospp-devel | pas de correctif indiqué |
| rapidfort alma 9 | librbd-devel | pas de correctif indiqué |
| rapidfort alma 9 | librbd1 | pas de correctif indiqué |
| rapidfort debian 12 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort debian 13 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort fedora 43 | cockpit-ha-cluster | 0.12.2-2.fc43 |
| rapidfort fedora 43 | nextcloud | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-httpd | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-mysql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-nginx | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-postgresql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-sqlite | 33.0.3-1.fc43 |
| rapidfort fedora 43 | pcs | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-snmp | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-web-ui | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pgadmin4 | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-doc | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-httpd | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-cs | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-de | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-es | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-fr | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-it | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ja | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ko | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-pl | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ru | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-qt | 9.14-1.fc43 |
| rapidfort fedora 43 | python-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python-jupytext-doc | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupyterlab-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | yarnpkg | 1.22.22-18.fc43 |
| rapidfort Oracle Linux 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-files | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | cockpit-ha-cluster | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | cockpit-image-builder | 0:94.3-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-machines | pas de correctif indiqué |
| rapidfort Oracle Linux 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-httpd | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-mysql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-nginx | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-postgresql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-sqlite | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | pcs | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | pcs-snmp | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | yarnpkg | 1.22.22-18.el10_3 |
| rapidfort Oracle Linux 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-files | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | cockpit-machines | pas de correctif indiqué |
| rapidfort Oracle Linux 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | pcs | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | pcs-snmp | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | yarnpkg | 1.22.22-18.el9 |
| rapidfort Red Hat 10 | cockpit-podman | pas de correctif indiqué |
| rapidfort Red Hat 9 | cockpit-podman | pas de correctif indiqué |
| rapidfort rocky 10 | cockpit-files | pas de correctif indiqué |
| rapidfort rocky 10 | cockpit-machines | pas de correctif indiqué |
| rapidfort rocky 10 | cockpit-podman | pas de correctif indiqué |
| rapidfort rocky 8 | cockpit | pas de correctif indiqué |
| rapidfort rocky 8 | cockpit-bridge | pas de correctif indiqué |
| rapidfort rocky 8 | cockpit-machines | pas de correctif indiqué |
| rapidfort rocky 8 | cockpit-ws | pas de correctif indiqué |
| rapidfort rocky 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-files | pas de correctif indiqué |
| rapidfort rocky 9 | cockpit-machines | pas de correctif indiqué |
| rapidfort rocky 9 | cockpit-podman | pas de correctif indiqué |
| rapidfort rocky 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort ubuntu 20.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 20.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| Red Hat | cockpit | pas de correctif indiqué |
| Red Hat | cockpit-bridge | pas de correctif indiqué |
| Red Hat | cockpit-dashboard | pas de correctif indiqué |
| Red Hat | cockpit-doc | pas de correctif indiqué |
| Red Hat | cockpit-files | pas de correctif indiqué |
| Red Hat | cockpit-machines | pas de correctif indiqué |
| Red Hat | cockpit-packagekit | pas de correctif indiqué |
| Red Hat | cockpit-pcp | pas de correctif indiqué |
| Red Hat | cockpit-podman | pas de correctif indiqué |
| Red Hat | cockpit-storaged | pas de correctif indiqué |
| Red Hat | cockpit-system | pas de correctif indiqué |
| Red Hat | cockpit-ws | pas de correctif indiqué |
| Red Hat | container-tools:rhel8::cockpit-podman | pas de correctif indiqué |
| Red Hat | librados-devel | pas de correctif indiqué |
| Red Hat | librados2 | pas de correctif indiqué |
| Red Hat | libradospp-devel | pas de correctif indiqué |
| Red Hat | librbd-devel | pas de correctif indiqué |
| Red Hat | librbd1 | pas de correctif indiqué |
| Red Hat | lodash | pas de correctif indiqué |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | pas de correctif indiqué |
| Red Hat | openshift-service-mesh/kiali-rhel8 | pas de correctif indiqué |
| Red Hat | openshift4/nmstate-console-plugin-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-agent-installer-ui-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-console | pas de correctif indiqué |
| Red Hat | openshift4/ose-console-rhel9 | pas de correctif indiqué |
| Red Hat | openshift4/ose-networking-console-plugin-rhel9 | pas de correctif indiqué |
| Red Hat | pcs | pas de correctif indiqué |
| Red Hat | pcs-snmp | pas de correctif indiqué |
| Red Hat | rhsm-icons | pas de correctif indiqué |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | pas de correctif indiqué |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | pas de correctif indiqué |
| Red Hat | satellite/iop-remediations-rhel9 | pas de correctif indiqué |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | pas de correctif indiqué |
| Red Hat | subscription-manager-cockpit | pas de correctif indiqué |
| rocky 10 | cockpit-image-builder | 94.3-1.el10_2 |
| seal npm::Seal Security Database | @seal-security/lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | @seal-security/lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | @seal-security/lodash.template | 4.5.0-sp2 |
| seal npm::Seal Security Database | lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | lodash.template | 4.5.0-sp2 |
| ubuntu 18.04-ESM | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 |
| ubuntu 22.04 | node-lodash | pas de correctif indiqué |
| ubuntu 24.04 | node-lodash | pas de correctif indiqué |
| ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 |
| ubuntu 26.04 | node-lodash | pas de correctif indiqué |
| wolfi | argo-workflows-4.0 | 4.0.4-r0 |
| wolfi | code-server | 4.112.0-r2 |
| wolfi | jitsucom-jitsu | 2.11.0-r19 |
| wolfi | json-server | 0.17.4-r6 |
| wolfi | jupyter-base-notebook | 7.6.3-r2 |
| wolfi | kubeflow-centraldashboard | 1.10.0-r18 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | kubeflow-pipelines | 2.16.0-r11 |
| wolfi | langfuse-3 | 3.164.0-r1 |
| wolfi | npm | 11.12.1-r3 |
| wolfi | opensearch-dashboards-3 | 3.5.0-r15 |
| wolfi | prism | 5.15.6-r2 |
| wolfi | py3-jupyterlab | 4.6.1-r1 |
| wolfi | renovate | 43.104.7-r1 |
| wolfi | saf | 1.6.0-r0 |
| wolfi | sqlpad | 7.5.7-r17 |
| wolfi | ts-patch | 4.0.1-r3 |
| wolfi | vitess-23 | 23.0.3-r12 |
Références
- https://access.redhat.com/errata/RHBA-2026:21387
- https://access.redhat.com/errata/RHSA-2026:10131
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10710
- https://access.redhat.com/errata/RHSA-2026:10713
- https://access.redhat.com/errata/RHSA-2026:11454
- https://access.redhat.com/errata/RHSA-2026:11469
- https://access.redhat.com/errata/RHSA-2026:11470
Les 97 références
- https://access.redhat.com/errata/RHSA-2026:11471
- https://access.redhat.com/errata/RHSA-2026:11493
- https://access.redhat.com/errata/RHSA-2026:11494
- https://access.redhat.com/errata/RHSA-2026:11495
- https://access.redhat.com/errata/RHSA-2026:11516
- https://access.redhat.com/errata/RHSA-2026:12277
- https://access.redhat.com/errata/RHSA-2026:12279
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14870
- https://access.redhat.com/errata/RHSA-2026:14871
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17448
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17469
- https://access.redhat.com/errata/RHSA-2026:17547
- https://access.redhat.com/errata/RHSA-2026:17549
- https://access.redhat.com/errata/RHSA-2026:17550
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:19008
- https://access.redhat.com/errata/RHSA-2026:19167
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:20042
- https://access.redhat.com/errata/RHSA-2026:20943
- https://access.redhat.com/errata/RHSA-2026:20946
- https://access.redhat.com/errata/RHSA-2026:21658
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:24331
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:29795
- https://access.redhat.com/errata/RHSA-2026:34100
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36621
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40795
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:44235
- https://access.redhat.com/errata/RHSA-2026:48699
- https://access.redhat.com/errata/RHSA-2026:54188
- https://access.redhat.com/errata/RHSA-2026:56789
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:59833
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8498
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-4800
- https://advisory.echohq.com/cve/CVE-2026-4800
- https://bugzilla.redhat.com/2453496
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740
- https://bugzilla.redhat.com/show_bug.cgi?id=2453496
- https://cna.openjsf.org/security-advisories.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800
- https://errata.almalinux.org/9/ALSA-2026-19167.html
- https://errata.rockylinux.org/RLSA-2026:24331
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm
- https://github.com/advisories/GHSA-r5fr-rjxr-66jc
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
- https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
- https://linux.oracle.com/cve/CVE-2026-4800.html
- https://linux.oracle.com/errata/ELSA-2026-24331.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4800
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json
- https://ubuntu.com/security/notices/USN-8411-1
- https://www.cve.org/CVERecord?id=CVE-2026-4800