Critical Security Flaw in cockpit-image-builder: Prototype Pollution and Arbitrary Code Execution
Summary
RLSA-2026:24331: Important: cockpit-image-builder security update. Affects cockpit-image-builder versions < 0:94.3-1.el10_2. Fixed in 0:94.3-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cockpit-image-builder is a tool that generates custom images for deploying systems or uploading to the cloud. It serves as a frontend for osbuild within the Cockpit interface, allowing users to create and manage system images efficiently. However, recent vulnerabilities have been identified that could compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from issues in the lodash library used by cockpit-image-builder. Specifically, there are two critical vulnerabilities: CVE-2025-13465, which allows for prototype pollution through the _.unset and _.omit functions, and CVE-2026-4800, which enables arbitrary code execution via untrusted input in template imports. These vulnerabilities can lead to unauthorized access and manipulation of system data, potentially allowing attackers to execute malicious code.
How To Fix
Minimum fixed version
0:94.3-1.el10_2
This is the first release that contains the fix.
sudo dnf update cockpit-image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected lodash functions in your application until the package can be updated. Additionally, validate and sanitize all user inputs to mitigate the risk of arbitrary code execution.
Conclusion
The identified vulnerabilities in cockpit-image-builder pose significant risks to system security. It is crucial to update to the latest version to mitigate these risks. Users should also consider using Vulert to monitor for vulnerabilities in their software without needing to install additional tools.
See every vulnerability recorded for cockpit-image-builder →
FAQ
cockpit-image-builder is a tool that helps users create custom images for system deployment or cloud uploads, integrating with the Cockpit interface.
The main vulnerabilities are prototype pollution and arbitrary code execution due to issues in the lodash library used by cockpit-image-builder.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.2, indicating a high level of severity.
If you cannot update the package immediately, ensure to validate and sanitize all user inputs and avoid using the affected lodash functions as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-image-builder.
