Red Hat released a security advisory for Ansible Automation Platform 2.6 container update addressing several vulnerabilities including CVE-2025-13465, a prototype pollution flaw in Lodash's _.unset and _.omit functions. This vulnerability allows attackers controlling property paths to delete prototype methods, potentially causing denial of service by removing essential functionalities. The issue is exploitable only if user input controls the property paths passed to these functions. Red Hat's advisory includes a fix in the updated container images and recommends applying the update after prior errata. The vulnerability affects versions >=2.6.0 <2.7.0 of the platform. No known exploits are reported in the wild.

The prototype pollution vulnerability can cause denial of service by deleting critical prototype methods, impacting availability of the affected application components. The impact is limited to denial of service without confidentiality or integrity compromise. The vulnerability affects the pcs-web-ui component bundled with Lodash in versions prior to the update. Red Hat rates the severity as high due to availability impact, but notes that the issue only affects applications that use the vulnerable Lodash functions with user-controlled input. No active exploitation is known.

Red Hat has released an official update for Ansible Automation Platform 2.6 container images that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata are installed. Additionally, to mitigate the Lodash prototype pollution issue, strict input validation should be implemented to block dangerous property paths such as '__proto__', 'constructor', and 'prototype' before passing them to _.unset and _.omit functions. No other immediate actions are required beyond applying the vendor-provided update.