StackRadarChart IndexLive demo

CVE-2019-16769

Medium

Advisory

Published 5 Dec 2019In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.2; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 10; of 17,781 indexed, latest versions
Container images: 10; deployed by those charts
Fix available: 1 of 1; affected package

Cross-Site Scripting in serialize-javascript

Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 10 images.

Affected package	Affected versions	Fixed in	Images
serialize-javascriptnpm	1.6.1, 1.7.0, 1.9.1	2.1.1	10

OSV records: GHSA-h9rv-jmmf-4pgx

Charts affected

10 by stars

Chart

Latest

Affected images

Radar Score

flagsmithone-acre-fund

1 of 6 See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
flagsmith/flagsmith-frontend :v2.6.0	df02a29e8b0c	serialize-javascript@1.7.0	2.1.1

Open the chart page →

6,868

angular-chartangular-application

1 of 1 See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	serialize-javascript@1.9.1	2.1.1

Open the chart page →

3,237

daskcloudnativeapp

1 of 2 See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
daskdev/dask-notebook :1.1.0	052630f5ca04	serialize-javascript@1.6.1	2.1.1

Open the chart page →

29,901

developer-dashboardcloud-native-toolkit

1 of 1 See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	serialize-javascript@1.7.0	2.1.1

Open the chart page →

25,456

conduction-uiconduction-ui

1 of 6 See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
conduction/conduction-ui-app :dev	d591f5e6f2a9	serialize-javascript@1.9.1	2.1.1

Open the chart page →

12,907

ibm-app-navigatoribm-charts

1 of 5 See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
ibmcom/app-nav-ui :1.0.1	e2a86997b36b	serialize-javascript@1.7.0	2.1.1

Open the chart page →

32,915

yapijoelee2012

1 of 1 See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
jayfong/yapi :1.10.2	163e5d621910	serialize-javascript@1.9.1	2.1.1

Open the chart page →

6,454

opendistro-eslsst-sqre

1 of 3 See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.4.0	5126e2e79a1f	serialize-javascript@1.7.0	2.1.1

Open the chart page →

7,929

codimdphntom

1 of 3 See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
phntom/codimd :2.4.3	1b9aafbb62e6	serialize-javascript@1.9.1	2.1.1

Open the chart page →

6,524

fdi-dotstatsuite-dlmstatcan

1 of 1 See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2019-16769.

Container image	Digest	Package	Fixed in
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	serialize-javascript@1.9.1	2.1.1

Open the chart page →

3,881

Container images carrying it

10 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
amazon/opendistro-for-elasticsearch-kibana :1.4.0	5126e2e79a1f	serialize-javascript@1.7.0	2.1.1	1
conduction/conduction-ui-app :dev	d591f5e6f2a9	serialize-javascript@1.9.1	2.1.1	1
daskdev/dask-notebook :1.1.0	052630f5ca04	serialize-javascript@1.6.1	2.1.1	1
flagsmith/flagsmith-frontend :v2.6.0	df02a29e8b0c	serialize-javascript@1.7.0	2.1.1	1
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	serialize-javascript@1.9.1	2.1.1	1
ibmcom/app-nav-ui :1.0.1	e2a86997b36b	serialize-javascript@1.7.0	2.1.1	1
jayfong/yapi :1.10.2	163e5d621910	serialize-javascript@1.9.1	2.1.1	1
phntom/codimd :2.4.3	1b9aafbb62e6	serialize-javascript@1.9.1	2.1.1	1
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	serialize-javascript@1.9.1	2.1.1	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	serialize-javascript@1.7.0	2.1.1	1