StackRadar

CVE-2019-3902

Medium

Advisory

Published 22 Apr 2019In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
126
of 17,781 indexed, latest versions
Container images
119
deployed by those charts
Fix available
3 of 3
affected packages

Mercurial Path Traversal/Link Following vulnerability

Carried by container images the latest versions of 126 of 17,781 indexed charts deploy, on 119 images.

Affected packageAffected versionsFixed inImages
mercurialpypi3.1.2, 3.7.3, 4.0, 4.8.24.9119
mercurialapk4.8.2-r04.9-r02
mercurialdeb3.1.2-2+deb8u3, 3.1.2-2+deb8u43.1.2-2+deb8u714
OSV records
ALPINE-CVE-2019-3902GHSA-mq66-vcfc-8246DLA-1764-1
Also known as
PYSEC-2019-188

Charts affected

126 by stars
ChartLatestAffected imagesRadar Score
prometheus-aws-costs-exporterdeliveryheroVerified publisher0.1.51 of 1See more

prometheus-aws-costs-exporter deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
mercurial@4.0
4.9

Open the chart page →

3,553
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
mercurial@4.8.2
4.9

Open the chart page →

2,770
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.01 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
mercurial@4.0
4.9

Open the chart page →

27,550
dnation-kubernetes-linterdnationcloud0.1.21 of 1See more

dnation-kubernetes-linter dnationcloud 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
dnationcloud/kubernetes-linter:0.2.1dee6376560f5
mercurial@4.8.2
4.9

Open the chart page →

2,114
mergeabledoubanVerified publisher0.2.21 of 1See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/leoquote/mergeable:latest451706815103
mercurial@4.0
4.9

Open the chart page →

4,223
eoloplannerdreyg-jescribanob-chart-eoloplanner0.1.01 of 7See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
mercurial@4.0
4.9

Open the chart page →

24,656
backend-charteks-3-tier-app-chart0.1.01 of 1See more

backend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
arfath29/3-tier-app-backend:latestee0750b18406
mercurial@4.8.2
4.9

Open the chart page →

1,693
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
mercurial@4.8.2
4.9

Open the chart page →

3,744
eolicplantseolicplantsVerified publisher0.1.01 of 7See more

eolicplants eolicplants 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
mercurial@4.0
4.9

Open the chart page →

27,291
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.01 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
mercurial@4.0
4.9

Open the chart page →

27,256
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
arturisimo/server-urjc:v1.0d8dc4430531e
mercurial@4.8.2
4.9

Open the chart page →

27,096
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
mercurial@4.0
4.9

Open the chart page →

3,260
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
mercurial@4.8.2
4.9

Open the chart page →

3,892
bae-activation-servicefiware0.1.21 of 1See more

bae-activation-service fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
fiware/bae-activation-service:v0.0.33e3ec88d59ed
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,186
guacamolegabibbo970.3.01 of 3See more

guacamole gabibbo97 0.3.0

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
guacamole/guacamole:1.3.0739cb6820ae8
mercurial@4.8.2
4.9

Open the chart page →

6,412
comcastgeek-cookbookVerified publisher6.4.21 of 1See more

comcast geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
billimek/comcastusage-for-influxdb:latest801bba1228ac
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,245
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
mercurial@4.8.2
4.9

Open the chart page →

1,713
gitter-irc-bridgehalkeye0.1.11 of 1See more

gitter-irc-bridge halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
mercurial@4.0
4.9

Open the chart page →

3,642
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
mercurial@4.0
4.9

Open the chart page →

3,809
hawk-envoy-pluginhawk0.1.02 of 4See more

hawk-envoy-plugin hawk 0.1.0

2 of the 4 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/privacyengineering/collector-go:main7217f1a4fa28
mercurial@4.8.2
4.9
ghcr.io/privacyengineering/consumer:main73f59c032812
mercurial@4.8.2
4.9

Open the chart page →

9,096
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
mercurial@4.8.2
4.9

Open the chart page →

8,213
prometheus-aws-costs-exporterhelm-charts-nr0.1.51 of 1See more

prometheus-aws-costs-exporter helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
mercurial@4.0
4.9

Open the chart page →

3,553
delta-sharing-serverinseefrlab1.2.11 of 1See more

delta-sharing-server inseefrlab 1.2.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
deltaio/delta-sharing-server:0.2.08b75118187c5
mercurial@4.8.2
4.9

Open the chart page →

6,174
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
mercurial@4.8.2
4.9

Open the chart page →

7,232
jenkinsjenkins-x0.10.381 of 2See more

jenkins jenkins-x 0.10.38

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
jenkinsci/jenkins:2.67a1f33f004659
mercurial@4.0
4.9

Open the chart page →

10,682
oauth2-proxyjenkins-x0.2.31 of 1See more

oauth2-proxy jenkins-x 0.2.3

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
a5huynh/oauth2_proxy:2.20c7307d31ca8
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.9
3.1.2-2+deb8u7

Open the chart page →

2,392
annotation-tooljtektVerified publisher0.1.51 of 2See more

annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
mercurial@4.0
4.9

Open the chart page →

2,315
polygonal-annotation-tooljtektVerified publisher0.1.51 of 2See more

polygonal-annotation-tool jtekt 0.1.5

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/api-proxy:a3e8b41e9e578c9653b6
mercurial@4.0
4.9

Open the chart page →

2,231
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
mercurial@4.0
4.9

Open the chart page →

4,185
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
mercurial@4.8.2
4.9

Open the chart page →

5,410
ladeitladeit0.4.01 of 2See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ladeit/ladeit:latest962b665ffe82
mercurial@4.8.2
4.9

Open the chart page →

26,356
stremiolbenicio-communityVerified publisher0.1.11 of 2See more

stremio lbenicio-community 0.1.1

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
stremio/server:latest3dc145603def
mercurial@4.8.2
4.9

Open the chart page →

2,600
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
mercurial@4.8.2
4.9

Open the chart page →

4,067
alert-stream-schema-registrylsst-sqre2.1.01 of 1See more

alert-stream-schema-registry lsst-sqre 2.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
lsstdm/lsst_alert_packet:tickets-DM-3274374c97a490940
mercurial@4.8.2
4.9

Open the chart page →

2,293
alert-stream-simulatorlsst-sqre1.6.21 of 1See more

alert-stream-simulator lsst-sqre 1.6.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
lsstdm/alert-stream-simulator:v1.2.1973df082d006
mercurial@4.8.2
4.9

Open the chart page →

2,089
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
mercurial@4.8.2
4.9

Open the chart page →

3,052
squash-apilsst-sqre0.1.61 of 3See more

squash-api lsst-sqre 0.1.6

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
lsstsqre/squash-api:0.5.34879415ec6ac
mercurial@4.8.2
4.9

Open the chart page →

6,611
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
mercurial@4.0
4.9

Open the chart page →

5,287
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
mercurial@4.0
4.9

Open the chart page →

2,599
o1-botminaVerified publisher0.0.31 of 1See more

o1-bot mina 0.0.3

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
codaprotocol/coda-user-agent:0.1.54ba4dd3a041f
mercurial@4.0
4.9

Open the chart page →

2,655
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
mercurial@4.8.2
4.9

Open the chart page →

6,438
api-proxymoreillonVerified publisher0.1.41 of 1See more

api-proxy moreillon 0.1.4

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/api-proxy:2373c1953739ef6956b5
mercurial@4.8.2
4.9

Open the chart page →

1,712
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/camera-proxy:latestce60056b50c2
mercurial@4.8.2
4.9

Open the chart page →

11,643
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
mercurial@4.0
4.9

Open the chart page →

8,556
group-managermoreillonVerified publisher0.4.41 of 3See more

group-manager moreillon 0.4.4

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/group-manager:v4.9.0d5a0ec8394c0
mercurial@4.8.2
4.9

Open the chart page →

9,835
mqtt-loggermoreillonVerified publisher0.3.11 of 5See more

mqtt-logger moreillon 0.3.1

1 of the 5 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/mqtt-logger:9ffbf7180a8a7daf56f6
mercurial@4.8.2
4.9

Open the chart page →

10,959
user-manager-neo4jmoreillonVerified publisher0.9.71 of 6See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
moreillon/group-manager:v4.9.0d5a0ec8394c0
mercurial@4.8.2
4.9

Open the chart page →

30,363
mozalert-controllermozilla0.4.01 of 1See more

mozalert-controller mozilla 0.4.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
afrank/mozalert-controller:latestd463c37b08d7
mercurial@4.8.2
4.9

Open the chart page →

2,969
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
mercurial@4.8.2
4.9

Open the chart page →

6,684
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
mercurial@4.8.2
4.9

Open the chart page →

3,128

Container images carrying it

119 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
gollumorg/gollum:latest7cd5305a3cf7
mercurial@4.8.2
4.9
1
guacamole/guacamole:1.3.0739cb6820ae8
mercurial@4.8.2
4.9
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
mercurial@4.0
4.9
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
mercurial@4.0
4.9
1
hickey/puppet_forge:1.10.0c1148a09ef20
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
i4trust/pdc-portal:2.0.03e77858e1219
mercurial@4.0
4.9
1
jenkinsci/jenkins:2.67a1f33f004659
mercurial@4.0
4.9
1
ladeit/ladeit:latest962b665ffe82
mercurial@4.8.2
4.9
1
leeyoongti/first-app:1.0.021d66cb76352
mercurial@4.0
4.9
1
library/node:16.20f77a1aef2da8
mercurial@4.8.2
4.9
1
library/sonarqube:6.7.6-community0ae5169e3d0f
mercurial@4.0
4.9
1
lsstdm/alert-stream-simulator:v1.2.1973df082d006
mercurial@4.8.2
4.9
1
lsstdm/lsst_alert_packet:tickets-DM-3274374c97a490940
mercurial@4.8.2
4.9
1
lsstsqre/kafkaaggregator:masterbe1b21060854
mercurial@4.8.2
4.9
1
lsstsqre/squash-api:0.5.34879415ec6ac
mercurial@4.8.2
4.9
1
moreillon/api-proxy:2373c1953739ef6956b5
mercurial@4.8.2
4.9
1
moreillon/camera-proxy:latestce60056b50c2
mercurial@4.8.2
4.9
1
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
mercurial@4.0
4.9
1
moreillon/mqtt-logger:9ffbf7180a8a7daf56f6
mercurial@4.8.2
4.9
1
mozilla/sentencecollector:2.0.91da6ff5c4895
mercurial@4.8.2
4.9
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
mercurial@4.0
4.9
1
neilpeterson/aks-helloworld:v1fb47732ef36b
mercurial@4.0
4.9
1
neilpeterson/burst-scheduler:v1.23a8877032972
mercurial@4.0
4.9
1
neilpeterson/chart-tweet:latest64fd8dab075f
mercurial@4.0
4.9
1
neilpeterson/get-tweet:v28b645ac1a23e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-container-instances-demo:latest6527b05d5d03
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-cosmos-mongodb-demo:latestf4940e84ed05
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-mysql-demo:latest5859d68a6c9f
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-storage-demo:latest29d229ab446e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-text-analytics-demo:latest969af3cb8466
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/process-tweet:latest39ce9f92e899
mercurial@4.0
4.9
1
nmalhotr/webserver:v1.0.03419361fb0dd
mercurial@4.8.2
4.9
1
nodered/node-red-docker:0.19.6-v8070643219ea2
mercurial@4.0
4.9
1
ondrejsika/parking:latestb1fd497416c8
mercurial@4.0
4.9
1
openproject/community:12.0.2734743d11094
mercurial@4.8.2
4.9
1
openwhisk/alarmprovider:2.2.0b695a6ceb406
mercurial@4.0
4.9
1
openwhisk/kafkaprovider:2.1.063dc3d2a0904
mercurial@4.8.2
4.9
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
mercurial@4.0
4.9
1
patdada/bella-docker:v1.0.075127147a624
mercurial@4.8.2
4.9
1
pecan/monitor:1.7.273b2074f3fec
mercurial@4.8.2
4.9
1
plumdog/db-operator:latest0c2fa2db0357
mercurial@4.8.2
4.9
1
rakii8585/angular-node-webapp:latest026082a515ac
mercurial@4.0
4.9
1
raykrueger/riemann:0.2.14c8baf3de57bb
mercurial@4.0
4.9
1
rlex/jsonvisio:1.9.5cd50ff65118e
mercurial@4.8.2
4.9
1
roadiehq/community-backstage-image:latestef355bf5b639
mercurial@4.8.2
4.9
1
robotshop/rs-cart:latest388349d5cb3c
mercurial@4.0
4.9
1
robotshop/rs-catalogue:latestd545747c1b97
mercurial@4.0
4.9
1
robotshop/rs-user:latestea509182c180
mercurial@4.0
4.9
1
royalwang/sentinel-dashboard:1.8.4df99e2499f91
mercurial@4.0
4.9
1
samajh/alprbackend:latestea742b4372ad
mercurial@4.8.2
4.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.