Kritik CVSS 9.8 PoC var

CVE-2026-29063: Immutable: prototip kirliliği

Yayın: 6 Mart 2026 22:16 · Güncelleme: 6 Kasım 2026 10:18

Açıklama (NVD)

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Özet bilgiler

Ürün: Immutable-js Immutable
CVSS v3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: %0,99 (yüzdelik 63)
CWE: CWE-1321
Yama: Yok / bilinmiyor

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
immutable-js-immutable	3.0.0	—	3.8.3
immutable-js-immutable	4.0.0	—	4.3.8
immutable-js-immutable	5.0.0	—	5.1.5
redhat-3scale-api-management-platform	2.0	2.0	—
redhat-advanced-cluster-management-for-kubernetes	2.14	—	2.14.3
redhat-advanced-cluster-management-for-kubernetes	2.15	—	2.15.2
redhat-advanced-cluster-management-for-kubernetes	2.16	—	2.16.1
redhat-advanced-cluster-security	4.8.0	—	4.8.11
redhat-advanced-cluster-security	4.9.0	—	4.9.6
redhat-advanced-cluster-security	4.10.0	—	4.10.2
redhat-ansible-automation-platform	2.0	2.0	—
redhat-build-of-apicurio-registry	2.0	2.0	—
redhat-connectivity-link	1.0	1.0	—
redhat-developer-hub	1.8.0	—	1.8.6
redhat-developer-hub	1.9.0	—	1.9.4
redhat-discovery	2.0	2.0	—
redhat-edge-manager	1.0	—	1.0.3
redhat-edge-manager	1.1	—	1.1.3
redhat-logging-subsystem-for-red-hat-openshift	—	—	—
redhat-migration-toolkit	1.8	1.8	—
redhat-migration-toolkit-for-virtualization	2.9.0	2.9.0	—
redhat-migration-toolkit-for-virtualization	2.10.0	2.10.0	—
redhat-multicluster-engine-for-kubernetes	2.6	—	2.6.10
redhat-multicluster-engine-for-kubernetes	2.7	—	2.7.10
redhat-multicluster-engine-for-kubernetes	2.8	—	2.8.5
redhat-multicluster-engine-for-kubernetes	2.9	—	2.9.3
redhat-multicluster-engine-for-kubernetes	2.10	—	2.10.2
redhat-multicluster-engine-for-kubernetes	2.11	—	2.11.1
redhat-network-observability-operator	1.11.0	1.11.0	—
redhat-network-observability-operator	1.12.3	1.12.3	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları