Dashboard / CVE-2026-29063

CVE-2026-29063

HIGH
MEDIUM Priority: 0.09 BB Relevance: 78/100
Published: 2026-03-06 Modified: 2026-10-30 First seen: 2026-10-30 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: High
VI: None
VA: None

Description

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Weakness Classification (2)

Affected Software (40)

VendorProductVersion
immutable-js immutable 3.0.0 – 3.8.3
redhat 3scale_api_management_platform 2.0
redhat advanced_cluster_management_for_kubernetes 2.14 – 2.14.3
redhat advanced_cluster_security 4.8.0 – 4.8.11
redhat advanced_cluster_security 4.10.0 – 4.10.2
redhat ansible_automation_platform 2.0
redhat build_of_apicurio_registry 2.0
redhat connectivity_link 1.0
redhat developer_hub 1.8.0 – 1.8.6
redhat discovery 2.0
redhat edge_manager 1.0 – 1.0.3
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux 10.0
redhat logging_subsystem_for_red_hat_openshift -
redhat migration_toolkit 1.8
redhat migration_toolkit_for_virtualization 2.9.0
redhat migration_toolkit_for_virtualization 2.10.0
redhat multicluster_engine_for_kubernetes 2.6 – 2.6.10
redhat network_observability_operator 1.11.0
redhat network_observability_operator 1.12.3
redhat openshift_cluster_observability_operator 1.5.3
redhat openshift_container_platform 4.12 – 4.12.93
redhat openshift_container_platform 4.0
redhat openshift_data_foundation 4.18 – 4.18.25
redhat openshift_data_foundation 4.17
redhat openshift_gitops -
redhat openshift_lightspeed -
redhat openshift_pipelines 1.20 – 1.20.5
redhat openshift_service_mesh 2.6
Showing 30 of 40 entries

References & Advisories (72)

Showing 25 of 72 references

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

1.01%
Raw Score 0.010150
Percentile 63.2%
Date 2026-10-30

EPSS Trend

2026-10-30
0.01015
2026-10-29
0.01015

Intelligence Sources

nvd ref →

External Links