by Kastro CVE-2026-29063
immutable-js immutable-js — Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable
Description · from the CVE record
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
Affected
ProductAffectedFixed inSource
immutable-js< 3.8.3–CNA
immutable-js< 4.3.7–CNA
immutable-js< 5.1.5–CNA
Cluster Observability Operator 1.5.0see advisory1782839279redhat-SADP
Cluster Observability Operator 1.5.0see advisory1782840539redhat-SADP
Cluster Observability Operator 1.5.0see advisory1782839996redhat-SADP
Migration Toolkit for Virtualization 2.1see advisory1779139872redhat-SADP
Migration Toolkit for Virtualization 2.9see advisory1778927462redhat-SADP
multicluster engine for Kubernetes 2.1see advisory1777128790redhat-SADP
multicluster engine for Kubernetes 2.11see advisory1777559392redhat-SADP
multicluster engine for Kubernetes 2.6see advisory1776223790redhat-SADP
multicluster engine for Kubernetes 2.7see advisory1777306226redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
redhat-SADP (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial