CVE-2026-29063 is a Prototype Pollution vulnerability in the Immutable.js library, affecting Red Hat products such as OpenShift Container Platform. The vulnerability allows attackers with low privileges to manipulate core JavaScript object prototypes through APIs like mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(). This can result in arbitrary code execution or denial of service. Exploitation requires the attacker to provide arbitrary data to these APIs, which generally implies some level of access to the affected application. Red Hat has issued security updates including OpenShift Container Platform 4.20.26 and updated container images to remediate this vulnerability.

An attacker with low privileges who can supply crafted data to the affected Immutable.js APIs may execute arbitrary code or cause denial of service in affected Red Hat products. The vulnerability impacts confidentiality, integrity, and availability. However, exploitation requires some level of access to the affected application to provide the malicious input.

Red Hat has released security updates in OpenShift Container Platform 4.20.26 and associated container images that fix this vulnerability. Users should upgrade to these updated packages and images as soon as they are available through the appropriate release channels. Instructions for upgrading are provided by Red Hat in their official documentation. No additional mitigations are specified beyond applying the official updates.