CVE-2026-29063 is a Prototype Pollution vulnerability in Immutable.js, affecting functions such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(). An attacker with low privileges who can supply arbitrary data to these functions can inject unwanted properties into JavaScript object prototypes, potentially leading to arbitrary code execution or denial of service. Exploitation requires the attacker to control input data passed to these APIs, which generally implies some level of access to the affected application. Red Hat has identified this vulnerability in multiple products including Red Hat Advanced Cluster Security for Kubernetes and Red Hat Satellite, among others. The vulnerability is rated high severity by Red Hat and is addressed in updated product versions.

The vulnerability allows an attacker with low privileges to perform Prototype Pollution, which can lead to modification of application data, unauthorized code execution, or denial of service. The impact includes high confidentiality, integrity, and availability risks as per Red Hat's CVSS assessment. Exploitation requires the attacker to provide crafted input to affected functions, which generally requires some level of access to the application. There are no known exploits in the wild at this time.

Red Hat has released updated versions of affected products that include fixes for this vulnerability. Users are advised to upgrade to the fixed versions as specified in the Red Hat advisory RHSA-2026:11070. Since this is a code-level vulnerability in a library, applying the vendor-provided patches or upgrading to the fixed product versions is the recommended mitigation. No alternative mitigations or workarounds are specified in the advisory.