This security advisory from Red Hat Product Security addresses vulnerabilities identified as CVE-2026-47428 and CVE-2026-47429 affecting Red Hat Hardened Images RPMs, notably prometheus3.13 packages. The issues relate to CWE-79 (Cross-site Scripting) and CWE-22 (Path Traversal). The advisory provides updated RPMs prometheus3.13-3.13.1-0.1.hum1 for aarch64 and x86_64 architectures and source RPMs. No detailed CVSS scores or affected version ranges are provided. The advisory does not list any known exploits in the wild and does not specify fixed or vulnerable versions explicitly. The update is classified as a bug fix and enhancement.

The vulnerabilities involve CWE-79 and CWE-22, which typically allow for cross-site scripting and path traversal attacks, potentially leading to unauthorized access or code execution. However, no known exploits in the wild have been reported. The impact is considered critical by Red Hat, indicating the potential for serious security consequences if exploited.

Red Hat has released updated RPM packages (prometheus3.13-3.13.1-0.1.hum1) addressing these vulnerabilities. Users of Red Hat Hardened Images should apply the update as provided by Red Hat. Since this is an official fix, applying the update will mitigate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory.