RHBA-2026:21388
Vulnerability from csaf_redhat - Published: 2026-05-27 16:49 - Updated: 2026-10-16 04:46Summary
Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update
Severity
Critical
Notes
Topic: An update for cockpit is now available for Red Hat Enterprise Linux 10.
Details: Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Bug Fix(es) and Enhancement(s):
* cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection [rhel-10.2] (JIRA:RHEL-158306)
* cockpit: lodash: Arbitrary code execution via untrusted input in template imports [rhel-10.2] (JIRA:RHEL-164067)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Lodash. An attacker can exploit a prototype pollution vulnerability in the `_.unset` and `_.omit` functions by bypassing a security check. This bypass is achieved by providing array-wrapped path segments, which allows for the deletion of properties from built-in JavaScript prototypes such as `Object.prototype`. This could lead to unexpected application behavior or denial of service.
6.5 (Medium)
Affected products
Fixed
26 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.
9.8 (Critical)
Affected products
Fixed
26 products, the same list as for
CVE-2026-2950
Threats
Impact
Critical
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Affected products
Fixed
26 products, the same list as for
CVE-2026-2950
Threats
Impact
Important
References
18 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for cockpit is now available for Red Hat Enterprise Linux 10.",
"title": "Topic"
},
{
"category": "general",
"text": "Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nBug Fix(es) and Enhancement(s):\n\n* cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection [rhel-10.2] (JIRA:RHEL-158306)\n\n* cockpit: lodash: Arbitrary code execution via untrusted input in template imports [rhel-10.2] (JIRA:RHEL-164067)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2026:21388",
"url": "https://access.redhat.com/errata/RHBA-2026:21388"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_21388.json"
}
],
"title": "Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-10-16T04:46:45+00:00",
"generator": {
"date": "2026-10-16T04:46:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHBA-2026:21388",
"initial_release_date": "2026-05-27T16:49:47+00:00",
"revision_history": [
{
"date": "2026-05-27T16:49:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-05-27T16:49:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-16T04:46:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux BaseOS (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-packagekit-0:356.1-1.el10_2.noarch",
"product": {
"name": "cockpit-packagekit-0:356.1-1.el10_2.noarch",
"product_id": "cockpit-packagekit-0:356.1-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-packagekit@356.1-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "cockpit-storaged-0:356.1-1.el10_2.noarch",
"product": {
"name": "cockpit-storaged-0:356.1-1.el10_2.noarch",
"product_id": "cockpit-storaged-0:356.1-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-storaged@356.1-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "cockpit-bridge-0:356.1-1.el10_2.noarch",
"product": {
"name": "cockpit-bridge-0:356.1-1.el10_2.noarch",
"product_id": "cockpit-bridge-0:356.1-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-bridge@356.1-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "cockpit-doc-0:356.1-1.el10_2.noarch",
"product": {
"name": "cockpit-doc-0:356.1-1.el10_2.noarch",
"product_id": "cockpit-doc-0:356.1-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-doc@356.1-1.el10_2?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "cockpit-system-0:356.1-1.el10_2.noarch",
"product": {
"name": "cockpit-system-0:356.1-1.el10_2.noarch",
"product_id": "cockpit-system-0:356.1-1.el10_2.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-system@356.1-1.el10_2?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-0:356.1-1.el10_2.src",
"product": {
"name": "cockpit-0:356.1-1.el10_2.src",
"product_id": "cockpit-0:356.1-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit@356.1-1.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-0:356.1-1.el10_2.aarch64",
"product": {
"name": "cockpit-0:356.1-1.el10_2.aarch64",
"product_id": "cockpit-0:356.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit@356.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-0:356.1-1.el10_2.aarch64",
"product": {
"name": "cockpit-ws-0:356.1-1.el10_2.aarch64",
"product_id": "cockpit-ws-0:356.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"product": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"product_id": "cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"product": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"product_id": "cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"product": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"product_id": "cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-0:356.1-1.el10_2.ppc64le",
"product": {
"name": "cockpit-0:356.1-1.el10_2.ppc64le",
"product_id": "cockpit-0:356.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit@356.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-0:356.1-1.el10_2.ppc64le",
"product": {
"name": "cockpit-ws-0:356.1-1.el10_2.ppc64le",
"product_id": "cockpit-ws-0:356.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"product": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"product_id": "cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"product": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"product_id": "cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"product": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"product_id": "cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-0:356.1-1.el10_2.s390x",
"product": {
"name": "cockpit-0:356.1-1.el10_2.s390x",
"product_id": "cockpit-0:356.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit@356.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-0:356.1-1.el10_2.s390x",
"product": {
"name": "cockpit-ws-0:356.1-1.el10_2.s390x",
"product_id": "cockpit-ws-0:356.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"product": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"product_id": "cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cockpit-debugsource-0:356.1-1.el10_2.s390x",
"product": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.s390x",
"product_id": "cockpit-debugsource-0:356.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"product": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"product_id": "cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cockpit-0:356.1-1.el10_2.x86_64",
"product": {
"name": "cockpit-0:356.1-1.el10_2.x86_64",
"product_id": "cockpit-0:356.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit@356.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-0:356.1-1.el10_2.x86_64",
"product": {
"name": "cockpit-ws-0:356.1-1.el10_2.x86_64",
"product_id": "cockpit-ws-0:356.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws@356.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.x86_64",
"product": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.x86_64",
"product_id": "cockpit-ws-selinux-0:356.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-ws-selinux@356.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"product": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"product_id": "cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debugsource@356.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"product": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"product_id": "cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/cockpit-debuginfo@356.1-1.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-packagekit-0:356.1-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch"
},
"product_reference": "cockpit-packagekit-0:356.1-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-storaged-0:356.1-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch"
},
"product_reference": "cockpit-storaged-0:356.1-1.el10_2.noarch",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-0:356.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64"
},
"product_reference": "cockpit-0:356.1-1.el10_2.aarch64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-0:356.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le"
},
"product_reference": "cockpit-0:356.1-1.el10_2.ppc64le",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-0:356.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x"
},
"product_reference": "cockpit-0:356.1-1.el10_2.s390x",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-0:356.1-1.el10_2.src as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src"
},
"product_reference": "cockpit-0:356.1-1.el10_2.src",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-0:356.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64"
},
"product_reference": "cockpit-0:356.1-1.el10_2.x86_64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-bridge-0:356.1-1.el10_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch"
},
"product_reference": "cockpit-bridge-0:356.1-1.el10_2.noarch",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64"
},
"product_reference": "cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le"
},
"product_reference": "cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x"
},
"product_reference": "cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debuginfo-0:356.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64"
},
"product_reference": "cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64"
},
"product_reference": "cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le"
},
"product_reference": "cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x"
},
"product_reference": "cockpit-debugsource-0:356.1-1.el10_2.s390x",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-debugsource-0:356.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64"
},
"product_reference": "cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-doc-0:356.1-1.el10_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch"
},
"product_reference": "cockpit-doc-0:356.1-1.el10_2.noarch",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-system-0:356.1-1.el10_2.noarch as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch"
},
"product_reference": "cockpit-system-0:356.1-1.el10_2.noarch",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-0:356.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64"
},
"product_reference": "cockpit-ws-0:356.1-1.el10_2.aarch64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-0:356.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le"
},
"product_reference": "cockpit-ws-0:356.1-1.el10_2.ppc64le",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-0:356.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x"
},
"product_reference": "cockpit-ws-0:356.1-1.el10_2.s390x",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-0:356.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64"
},
"product_reference": "cockpit-ws-0:356.1-1.el10_2.x86_64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64"
},
"product_reference": "cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le"
},
"product_reference": "cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x"
},
"product_reference": "cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"relates_to_product_reference": "BaseOS-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cockpit-ws-selinux-0:356.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10)",
"product_id": "BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
},
"product_reference": "cockpit-ws-selinux-0:356.1-1.el10_2.x86_64",
"relates_to_product_reference": "BaseOS-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-2950",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-31T20:01:38.424064+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453499"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Lodash. An attacker can exploit a prototype pollution vulnerability in the `_.unset` and `_.omit` functions by bypassing a security check. This bypass is achieved by providing array-wrapped path segments, which allows for the deletion of properties from built-in JavaScript prototypes such as `Object.prototype`. This could lead to unexpected application behavior or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2950"
},
{
"category": "external",
"summary": "RHBZ#2453499",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453499"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh"
}
],
"release_date": "2026-03-31T19:18:35.796000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-27T16:49:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2026:21388"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass"
},
{
"acknowledgments": [
{
"names": [
"Florian Kohnh\u00e4user"
]
}
],
"cve": "CVE-2026-4631",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-03-23T08:22:37.323000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450246"
}
],
"notes": [
{
"category": "description",
"text": "Cockpit\u0027s remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH options or shell commands, achieving code execution on the Cockpit host without valid credentials. The injection occurs during the authentication flow before any credential verification takes place, meaning no login is required to exploit the vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Two configuration factors determine whether a Cockpit installation is vulnerable to remote code execution.\n\nFirst, the hostname injection attack (injecting SSH options like -oProxyCommand via the URL path) is blocked by OpenSSH 9.6 and later, which validates hostnames and rejects shell metacharacters before establishing a connection. Systems running Cockpit 327 or later with an OpenSSH version older than 9.6 are vulnerable to unauthenticated remote code execution in the default configuration. Systems with OpenSSH 9.6 or later are not vulnerable to this attack path.\n\nSecond, the username injection attack (injecting shell commands via the SSH username) requires that the system\u0027s SSH configuration uses the %r (remote username) token within a Match exec directive. This is not part of any default OpenSSH configuration. Systems that do not use %r in a Match exec directive are not vulnerable to this attack path, regardless of OpenSSH version.\n\nBoth attack paths require network access to the Cockpit web service (port 9090 by default) and that remote host login is enabled, which is the default Cockpit configuration.\n\nThis security issue was introduced in Cockpit version 327. Due to that, the cockpit packages as shipped with Red Hat Enterprise Linux 8, and Red Hat Enterprise Linux 9 before release 9.6, were not affected by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4631"
},
{
"category": "external",
"summary": "RHBZ#2450246",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450246"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4631",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4631"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4631",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4631"
},
{
"category": "external",
"summary": "https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427",
"url": "https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427"
}
],
"release_date": "2026-04-07T15:52:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-27T16:49:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2026:21388"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "cockpit: Cockpit: Unauthenticated remote code execution due to SSH command-line argument injection"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc",
"url": "https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-05-27T16:49:47+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2026:21388"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:cockpit-packagekit-0:356.1-1.el10_2.noarch",
"AppStream-10.2.Z:cockpit-storaged-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.src",
"BaseOS-10.2.Z:cockpit-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-bridge-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debuginfo-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-debugsource-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-doc-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-system-0:356.1-1.el10_2.noarch",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-0:356.1-1.el10_2.x86_64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.aarch64",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.ppc64le",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.s390x",
"BaseOS-10.2.Z:cockpit-ws-selinux-0:356.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.