Important Security Update for pcs and pcs-snmp Packages: Prototype Pollution Vulnerability
Summary
ALSA-2026:2452: Important: pcs security update. Affects pcs versions < 0.11.10-1.el9_7.2. Fixed in 0.11.10-1.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pcs (Pacemaker Configuration System) and pcs-snmp packages are essential tools for managing and configuring the Pacemaker and Corosync utilities in high-availability clusters. These packages provide a command-line interface that allows system administrators to easily configure cluster resources and monitor their status. However, a recently discovered vulnerability in the lodash library, which is utilized by these packages, poses a significant security risk.
Vulnerability Detail
The vulnerability identified as CVE-2025-13465 involves prototype pollution in the lodash library, specifically within the _.unset and _.omit functions. This flaw allows an attacker to manipulate the prototype of an object, potentially leading to unauthorized access or modification of application data. If exploited, this vulnerability could compromise the integrity and security of the system, allowing attackers to execute arbitrary code or escalate privileges.
How To Fix
Minimum fixed version
0.11.10-1.el9_7.2
This is the first release that contains the fix.
sudo dnf update pcsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the packages is not immediately feasible, consider restricting access to the affected services or implementing additional security measures to mitigate potential exploitation of the vulnerability.
Conclusion
The pcs and pcs-snmp packages are critical for managing high-availability clusters, but a recently identified vulnerability in the lodash library poses a significant security risk. It is crucial to update these packages to the patched version to mitigate potential threats. Users are encouraged to monitor their systems and utilize tools like Vulert to stay informed about vulnerabilities.
See every vulnerability recorded for pcs →
FAQ
CVE-2025-13465 is a security vulnerability in the lodash library that allows for prototype pollution through the _.unset and _.omit functions.
If exploited, this vulnerability can lead to unauthorized access, data manipulation, and potential escalation of privileges on your system.
Consider implementing additional security measures or restricting access to the affected services until you can apply the necessary updates.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
For more details, refer to the CVE page for CVE-2025-13465, which provides insights into the impact and technical aspects of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for pcs.
