StackRadar

CVE-2017-1000048

High

Advisory

Published 30 Apr 2020In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.024
83rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
37
of 17,781 indexed, latest versions
Container images
33
deployed by those charts
Fix available
1 of 1
affected package

Prototype Pollution Protection Bypass in qs

Carried by container images the latest versions of 37 of 17,781 indexed charts deploy, on 33 images.

Affected packageAffected versionsFixed inImages
qsnpm0.5.6, 0.6.5, 0.6.6, 1.2.0+7 more6.0.4, 6.2.3, 6.3.233
OSV records
GHSA-gqgv-6jq5-jjj9

Charts affected

37 by stars
ChartLatestAffected imagesRadar Score
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@2.3.3
6.0.4

Open the chart page →

2,938
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
qs@6.2.1
6.2.3

Open the chart page →

10,732
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
qs@5.2.1
6.0.4

Open the chart page →

5,209
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@2.3.3
6.0.4

Open the chart page →

977
splice-helmsplice-helm0.1.71 of 13See more

splice-helm splice-helm 0.1.7

1 of the 13 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:3.0.0c36cf3cc1c99
qs@6.2.1
6.2.3

Open the chart page →

1,477
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
qs@5.2.1
6.0.4

Open the chart page →

18,277
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
qs@2.3.3
6.0.4

Open the chart page →

4,069
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
openthread/otbr:latestf307f59f6432
qs@2.2.4
6.0.4

Open the chart page →

12,779
ethereumcloudnativeapp1.0.01 of 3See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
qs@4.0.0
6.0.4

Open the chart page →

27,417
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
qs@6.3.0
6.3.2

Open the chart page →

77,758
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
qs@5.2.1
6.0.4

Open the chart page →

5,209
backend-servicedev-krishan-dhaka-charts1.0.31 of 1See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
devkrishan001/backend:latestf1c3acadeabe
qs@0.5.6
6.0.4

Open the chart page →

1,264
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
qs@2.3.3
6.0.4

Open the chart page →

1,755
testnet-faucetethereum-helm-chartsVerified publisher0.1.31 of 1See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
parithoshj/testnet-faucet:9859e0dcdca426fea6d
qs@2.3.3
6.0.4

Open the chart page →

3,005
logentriesfairwinds-incubator0.2.21 of 1See more

logentries fairwinds-incubator 0.2.2

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
logentries/docker-logentries:0.2.1f1f90a236998
qs@6.2.1
6.2.3

Open the chart page →

1,597
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
qs@2.3.3
6.0.4

Open the chart page →

5,941
gitter-irc-bridgehalkeye0.1.11 of 1See more

gitter-irc-bridge halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
qs@1.2.2
6.0.4

Open the chart page →

3,642
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
qs@1.2.2
6.0.4

Open the chart page →

3,003
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
qs@1.2.2
6.0.4
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
qs@1.2.2
6.0.4
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
qs@1.2.2
6.0.4
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
qs@1.2.2
6.0.4

Open the chart page →

89,959
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
qs@6.2.1
6.2.3

Open the chart page →

57,669
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
qs@6.3.0
6.3.2

Open the chart page →

4,614
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
qs@4.0.0
6.0.4

Open the chart page →

6,454
nubladolsst-sqre0.9.231 of 5See more

nublado lsst-sqre 0.9.23

1 of the 5 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
lsstsqre/sciplat-hub:latest5e0ade6bed1c
qs@6.2.1
6.2.3

Open the chart page →

5,786
iotmmontesVerified publisher0.3.21 of 7See more

iot mmontes 0.3.2

1 of the 7 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
ghcr.io/mmontes11/iot-worker:v3.11.0491bb243f555
qs@1.2.0
6.0.4

Open the chart page →

10,608
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
qs@0.6.5
6.0.4

Open the chart page →

14,809
reporting-legacy-apimojaloop2.2.01 of 1See more

reporting-legacy-api mojaloop 2.2.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
qs@0.6.5
6.0.4

Open the chart page →

1,948
monocularmonocular1.4.151 of 5See more

monocular monocular 1.4.15

1 of the 5 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
qs@6.3.0
6.3.2

Open the chart page →

7,048
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
qs@6.2.1
6.2.3

Open the chart page →

109,294
example-dev-toolsnoygal0.2.82 of 3See more

example-dev-tools noygal 0.2.8

2 of the 3 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
qs@0.6.6
6.0.4
linuxserver/codimd:latestb801bbcf6386
qs@2.3.3
6.0.4

Open the chart page →

27,465
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
qs@2.2.4
6.0.4

Open the chart page →

36,215
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
qs@2.3.3
6.0.4

Open the chart page →

3,118
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
qs@6.3.0
6.3.2

Open the chart page →

3,638
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@2.3.3
6.0.4

Open the chart page →

2,638
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
qs@5.2.1
6.0.4

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
qs@5.2.1
6.0.4

Open the chart page →

12,460
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
qs@4.0.0
6.0.4

Open the chart page →

3,827
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2017-1000048.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
qs@2.3.3
6.0.4

Open the chart page →

3,118

Container images carrying it

33 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
pantsel/konga:latestc8172b75607d
qs@5.2.1
6.0.4
3
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
qs@2.3.3
6.0.4
3
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
qs@5.2.1
6.0.4
2
migmartri/prerender:latest486aacfd5aa9
qs@6.3.0
6.3.2
2
mojaloop/reporting:v12.1.0d480a62103d6
qs@0.6.5
6.0.4
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
qs@2.3.3
6.0.4
2
devkrishan001/backend:latestf1c3acadeabe
qs@0.5.6
6.0.4
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
qs@4.0.0
6.0.4
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
qs@1.2.2
6.0.4
1
ibmcom/microclimate-portal:latested5505e5c7ec
qs@6.2.1
6.2.3
1
jayfong/yapi:1.10.2163e5d621910
qs@4.0.0
6.0.4
1
jupyterhub/configurable-http-proxy:3.0.0c36cf3cc1c99
qs@6.2.1
6.2.3
1
konradkleine/docker-registry-frontend:v2181aad54ee64
qs@2.3.3
6.0.4
1
linuxserver/cloud9:latest45c5fe102ff3
qs@0.6.6
6.0.4
1
linuxserver/codimd:latestb801bbcf6386
qs@2.3.3
6.0.4
1
logentries/docker-logentries:0.2.1f1f90a236998
qs@6.2.1
6.2.3
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
qs@6.2.1
6.2.3
1
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
qs@1.2.2
6.0.4
1
microcks/microcks-postman-runtime:latestcb72e46a1b3c
qs@6.2.1
6.2.3
1
openthread/otbr:latestf307f59f6432
qs@2.2.4
6.0.4
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
qs@2.2.4
6.0.4
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
qs@2.3.3
6.0.4
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
qs@6.2.1
6.2.3
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
qs@6.3.0
6.3.2
1
wekanteam/wekan:v4.2268a51f0327df
qs@2.3.3
6.0.4
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
qs@1.2.2
6.0.4
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
qs@1.2.2
6.0.4
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
qs@1.2.2
6.0.4
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
qs@1.2.2
6.0.4
1
ghcr.io/mmontes11/iot-worker:v3.11.0491bb243f555
qs@1.2.0
6.0.4
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
qs@2.3.3
6.0.4
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
qs@4.0.0
6.0.4
1
quay.io/wekan/wekan:v5.65cb17600883a3
qs@6.3.0
6.3.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.