Skip to contentRed Hat Ansible Automation Platform 2.1 vulnerabilities
- form-data, red hat cluster observability operator 1.5.0, cryostat 4 +77 more +79 moreform-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)CVE-2026-12143Fix available8.7 High
- shell-quote, red hat cluster observability operator 1.5.0, cryostat 4 +46 more +48 moreshell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`CVE-2026-9277Public exploitFix available9.2 Critical
- js-cookie javascript cookie, js-cookie, red hat cryostat 4 on rhel 9 +24 more +26 moreJavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injectionCVE-2026-46625Fix available7.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Breakout Using Async GeneratorCVE-2026-45411Fix available9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Breakout Through Null Proto ExceptionCVE-2026-44009Fix available9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2 has sandbox breakout via `neutralizeArraySpeciesBatch`CVE-2026-44008Fix available9.8 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionCVE-2026-44007Fix available9.1 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: NodeVM require.root bypass via symlink traversal allows sandbox escapeCVE-2026-43998Fix available8.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)CVE-2026-44004Fix available7.5 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)CVE-2026-44001Fix available8.6 High
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapeCVE-2026-43999Fix available9.9 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox escapeCVE-2026-44005Fix available10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox EscapeCVE-2026-43997Fix available10.0 Critical
- patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 morevm2: Sandbox EscapeCVE-2026-44006Fix available10.0 Critical
- redhat ansible automation platform, red hat ansible automation platform 2, ansible automation platform 2.16 +5 more +7 moreAnsible-automation-platform: privilege escalation via excessive group writable /etc/passwd permissionsCVE-2025-578476.4 Medium
- dchester jsonpath, red hat migration toolkit for virtualization, openshift pipelines +11 more +13 moreJSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-61140Fix available9.8 Critical