GHSA-wf6x-7x77-mvgw
Critical · 9.8CVSS
9.8
EPSS
—
Published
Mar 4, 2026
CISA due date
—
The record
Immutable is vulnerable to Prototype Pollution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | immutable | 0 | 3.8.3 |
| npm | immutable | 4.0.0-rc.1 | 4.3.8 |
| npm | immutable | 5.0.0 | 5.1.5 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.19-r3 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.10-r4 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.1-r4 |
| Chainguard | rancher-api-ui | 0 | 1.2.3-r6 |
| Chainguard | vitess-22 | 0 | 22.0.4-r6 |
| Chainguard | vitess-23 | 0 | 23.0.3-r7 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.10-r4 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.1-r4 |
| Wolfi | rancher-api-ui | 0 | 1.2.3-r6 |
| Wolfi | vitess-22 | 0 | 22.0.4-r6 |
| Wolfi | vitess-23 | 0 | 23.0.3-r7 |
Related vulnerabilities
- CVE-2026-29063 Immutable.js provides many Persistent Immutable data structures. Same vulnerability
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects argo-workflows-ui-3.6
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects argo-workflows-ui-3.6
- GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route… Also affects argo-workflows-ui-3.6
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects argo-workflows-ui-3.6
- CVE-2026-33671 Picomatch is a glob matcher written JavaScript. Also affects argo-workflows-ui-3.6
- CVE-2026-33672 Picomatch is a glob matcher written JavaScript. Also affects argo-workflows-ui-3.6
- GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion Also affects argo-workflows-ui-3.6