This security advisory covers Red Hat Advanced Cluster Management for Kubernetes 2.11 images, addressing multiple vulnerabilities including CVE-2025-9288. Among these, a prototype pollution vulnerability in Lodash's _.unset and _.omit functions allows attackers controlling property paths to delete methods from global prototypes, potentially causing denial of service. The vulnerability is exploitable only if user input controls the property paths passed to these functions. The advisory provides updated container images that include fixes and enhancements. The affected product is not a cloud service, and no known exploits are currently active in the wild.

The primary impact of the Lodash prototype pollution vulnerability is denial of service by removing essential functionalities from global prototypes, which can disrupt application behavior. The vulnerability does not allow overwriting behavior, limiting impact to availability. Other vulnerabilities addressed in the update are not detailed but contribute to the overall high severity rating. No active exploitation has been reported.

A security update is available in Red Hat Advanced Cluster Management for Kubernetes version 2.11.10 that includes fixes for the identified vulnerabilities. Users should apply this update after ensuring all previously released relevant errata are applied. For the Lodash prototype pollution issue, strict input validation should be implemented to block malicious property paths such as '__proto__', 'constructor', and 'prototype' before passing them to _.unset and _.omit functions. Refer to Red Hat's official advisory and update instructions for detailed remediation steps.