The Red Hat Security Advisory RHSA-2026:19409 addresses multiple vulnerabilities in the Migration Toolkit for Virtualization (MTV) RHEL9 images, including CVE-2026-29063, a Prototype Pollution vulnerability in the Immutable.js library. This flaw allows attackers with low privileges to manipulate core JavaScript object prototypes via specific API calls, potentially leading to arbitrary code execution or denial of service. Exploitation requires the attacker to supply crafted data to affected functions, typically necessitating some level of access to the application. The advisory lists a total of eight CVEs affecting the MTV product suite but does not specify fixed versions or detailed patch information. The vulnerabilities are associated with several CWEs such as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) and others related to integrity and code execution risks. The advisory recommends applying the latest updated images and ensuring all prior errata are applied.

The vulnerabilities collectively pose a high risk, including the potential for arbitrary code execution and denial of service. The Prototype Pollution vulnerability in Immutable.js can allow an attacker with limited privileges to alter application behavior or execute unauthorized commands. The overall impact affects data integrity, availability, and confidentiality within the affected MTV RHEL9 images. No known exploits in the wild have been reported at this time.

Red Hat has released updated MTV RHEL9 images that address these vulnerabilities. Users should ensure all previously released errata are applied before updating to the latest images. Detailed upgrade instructions are available in the official Red Hat documentation for the Migration Toolkit for Virtualization. Since no explicit patch versions are provided, users should rely on Red Hat's official advisory and update channels to obtain the fixed images. No additional mitigations are specified in the advisory.