Important Security Update for pcs Package: Prototype Pollution Vulnerability
Summary
ALSA-2026:2438: Important: pcs security update. Affects cockpit-ha-cluster versions < 0.12.1-1.el10_1.2. Fixed in 0.12.1-1.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs package provides a command-line configuration system for managing Pacemaker and Corosync utilities, which are essential for high-availability clustering in Linux environments. This package allows users to configure and manage cluster resources effectively, ensuring system reliability and uptime. However, it has been found to be vulnerable to a prototype pollution issue, which can potentially lead to unauthorized access or manipulation of application behavior.
Vulnerability Detail
The vulnerability identified as CVE-2025-13465 affects the lodash library used within the pcs package. It allows for prototype pollution through the _.unset and _.omit functions, which can lead to unexpected behavior in applications that rely on these functions. If exploited, an attacker could manipulate the prototype of an object, potentially leading to security breaches or application crashes. This vulnerability poses a significant risk, especially in environments where sensitive data is processed or where system integrity is critical.
How To Fix
Minimum fixed version
0.12.1-1.el10_1.2
This is the first release that contains the fix.
sudo dnf update cockpit-ha-clusterTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected lodash functions, _.unset and _.omit, in their applications until the package is updated. Additionally, reviewing and sanitizing input data can help mitigate the risk of exploitation.
Conclusion
In summary, the pcs package has a critical vulnerability related to prototype pollution that can affect the security of applications using it. Users are strongly advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can further enhance your security posture by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for cockpit-ha-cluster →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of an object in JavaScript, potentially leading to unauthorized access or modification of properties.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to fix this vulnerability could lead to unauthorized access, data manipulation, or application crashes, compromising the security and integrity of your system.
Yes, you should update to version 0.12.1-1.el10_1.2 or later of the pcs package to ensure that the vulnerability is patched.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. It helps you stay informed about potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-ha-cluster.
