Withdrawn by the publisher.

Affected: CleanStart: mongosh

Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details.

Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.

Affected: npm: lodash, npm: lodash-es, npm: lodash-amd, npm: lodash.unset

### Impact

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

### Patches

This issue is patched in 4.18.0.

### Workarounds

None. Upgrade to the patched version.

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards undici: Undici: Denial of Service via excessive decompression steps Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions yauzl: yauzl: Denial of Service vulnerability in zip file processing @backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling

Affected: Ubuntu:Pro:16.04:LTS: node-lodash, Ubuntu:Pro:18.04:LTS: node-lodash, Ubuntu:Pro:20.04:LTS: node-lodash, Ubuntu:Pro:22.04:LTS: node-lodash, Ubuntu:Pro:24.04:LTS: node-lodash, Ubuntu:25.10: node-lodash, Ubuntu:Pro:26.04:LTS: node-lodash

Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.

Ein Angreifer kann mehrere Schwachstellen in Red Hat Hardened Images RPMs ausnutzen, um einen Denial of Service Angriff durchzuführen oder Daten zu manipulieren.