The Red Hat Migration Toolkit for Virtualization (MTV) RHEL9 images are affected by multiple security vulnerabilities, including CVE-2026-29063, a Prototype Pollution vulnerability in the Immutable.js library. This flaw allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes via specific API calls, such as mergeDeep() and Map.toJS(), potentially enabling arbitrary code execution or denial of service. Exploitation requires the attacker to supply crafted data to affected functions, typically necessitating some level of access to the affected application. Red Hat's advisory RHSA-2026:19410 covers these issues and advises applying all relevant previously released errata before updating. The advisory does not provide explicit patch links but indicates updated images are available. The affected components include various MTV container images for RHEL9. No active exploitation has been observed.

Successful exploitation of these vulnerabilities could allow an attacker with some level of privileges to execute arbitrary code or cause denial of service by manipulating JavaScript object prototypes within the MTV RHEL9 images. This could compromise the integrity and availability of the affected systems. However, exploitation requires the attacker to be able to provide arbitrary data to the vulnerable functions, implying some degree of access to the affected environment. No known exploits in the wild have been reported, reducing immediate risk.

Red Hat has released updated MTV RHEL9 images addressing these vulnerabilities as part of advisory RHSA-2026:19410. Users should ensure all previously released errata relevant to their systems are applied before updating to the latest images. Since no explicit patch links are provided, users should follow Red Hat's official documentation and update procedures for the Migration Toolkit for Virtualization version 2.9. Monitoring Red Hat's security advisories for further updates is recommended. No additional mitigations are specified in the advisory.