Skip to main content
CVE-2026-2950VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Affects Red HatSource GCVE Database

0
Compare

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 11 Apr 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

AI-suggested

Red Hat has released an update for the yarnpkg RPMs included in Red Hat Hardened Images to address this vulnerability. Users should apply this update as per Red Hat's guidance. Currently, no other mitigations meet Red Hat's criteria for ease of use and applicability. Users are advised to follow Red Hat's official update procedures and monitor Red Hat advisories for further information.

Description

A prototype pollution vulnerability exists in Lodash's _.unset and _.omit functions, allowing attackers to bypass security checks by using array-wrapped path segments. This enables deletion of properties from built-in JavaScript prototypes such as Object.prototype, potentially causing unexpected application behavior or denial of service. Red Hat has issued an update for Red Hat Hardened Images RPMs including yarnpkg to address this issue. However, no direct mitigation is currently available that meets Red Hat's criteria for ease of use and applicability.

References

Community reviews

Loading reviews…