StackRadar

CVE-2019-3902

Medium

Advisory

Published 22 Apr 2019In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
126
of 17,781 indexed, latest versions
Container images
119
deployed by those charts
Fix available
3 of 3
affected packages

Mercurial Path Traversal/Link Following vulnerability

Carried by container images the latest versions of 126 of 17,781 indexed charts deploy, on 119 images.

Affected packageAffected versionsFixed inImages
mercurialpypi3.1.2, 3.7.3, 4.0, 4.8.24.9119
mercurialapk4.8.2-r04.9-r02
mercurialdeb3.1.2-2+deb8u3, 3.1.2-2+deb8u43.1.2-2+deb8u714
OSV records
ALPINE-CVE-2019-3902GHSA-mq66-vcfc-8246DLA-1764-1
Also known as
PYSEC-2019-188

Charts affected

126 by stars
ChartLatestAffected imagesRadar Score
myhelmappmyhelm-app1.1.01 of 1See more

myhelmapp myhelm-app 1.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
patdada/bella-docker:v1.0.075127147a624
mercurial@4.8.2
4.9

Open the chart page →

1,625
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
pecan/monitor:1.7.273b2074f3fec
mercurial@4.8.2
4.9

Open the chart page →

14,154
indexer-toolsnodeifyVerified publisher2.1.11 of 1See more

indexer-tools nodeify 2.1.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
mercurial@4.8.2
4.9

Open the chart page →

2,919
openwhiskopenwhisk1.0.02 of 10See more

openwhisk openwhisk 1.0.0

2 of the 10 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
openwhisk/alarmprovider:2.2.0b695a6ceb406
mercurial@4.0
4.9
openwhisk/kafkaprovider:2.1.063dc3d2a0904
mercurial@4.8.2
4.9

Open the chart page →

36,215
myappp4-helm0.1.02 of 6See more

myapp p4-helm 0.1.0

2 of the 6 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
mercurial@4.0
4.9
fjvela/urjc-fjvela-server:1.0.53c840aebce22
mercurial@4.0
4.9

Open the chart page →

19,720
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
slagattollas/server-practica:latest6dd8ead8e2b1
mercurial@4.0
4.9

Open the chart page →

28,484
jsonvisiorlex0.1.01 of 1See more

jsonvisio rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
rlex/jsonvisio:1.9.5cd50ff65118e
mercurial@4.8.2
4.9

Open the chart page →

2,100
test-helm-app2saam-helm-test0.1.01 of 1See more

test-helm-app2 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
asdkant/fastapi-hello-world:latesta23d8bf7c885
mercurial@4.8.2
4.9

Open the chart page →

2,770
classificationsignalen4.24.01 of 1See more

classification signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
mercurial@4.0
4.9

Open the chart page →

1,553
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
mercurial@4.0
4.9

Open the chart page →

3,696
simple-db-app-chartsimple-db-app0.1.01 of 2See more

simple-db-app-chart simple-db-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
htmlprogrammer2001/simple-db-app:1.0a7e0a233a9bc
mercurial@4.0
4.9

Open the chart page →

1,925
simple-db-app-chart-with-dependencysimple-db-app0.1.01 of 3See more

simple-db-app-chart-with-dependency simple-db-app 0.1.0

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
htmlprogrammer2001/simple-db-app:1.0a7e0a233a9bc
mercurial@4.0
4.9

Open the chart page →

1,925
first-appsimple-helm-chart0.1.01 of 1See more

first-app simple-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
leeyoongti/first-app:1.0.021d66cb76352
mercurial@4.0
4.9

Open the chart page →

2,154
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
mercurial@4.8.2
4.9

Open the chart page →

8,694
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
mercurial@4.8.2
4.9

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
mercurial@4.8.2
4.9

Open the chart page →

11,554
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,116
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
mercurial@4.0
4.9

Open the chart page →

11,841
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
mercurial@4.0
4.9

Open the chart page →

4,967
vehicle-dashboardtest-vehi-dash0.1.03 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

3 of the 7 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
library/node:16.20f77a1aef2da8
mercurial@4.8.2
4.9
samajh/alprbackend:latestea742b4372ad
mercurial@4.8.2
4.9
samajh/alprfrontend:latest05ef4fddbb75
mercurial@4.8.2
4.9

Open the chart page →

20,270
voteappvoting-app-helm-charts-repoVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.9

Open the chart page →

8,262
workerappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

workerapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.9

Open the chart page →

3,329
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.9

Open the chart page →

8,262
workerappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

workerapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.9

Open the chart page →

3,329
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
mercurial@4.0
4.9

Open the chart page →

2,559
weather-chartweather-web-app0.1.01 of 1See more

weather-chart weather-web-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
zohardocker12/weather_app_flask:latestb86d60dbb68d
mercurial@4.8.2
4.9

Open the chart page →

2,670

Container images carrying it

119 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
gollumorg/gollum:latest7cd5305a3cf7
mercurial@4.8.2
4.9
1
guacamole/guacamole:1.3.0739cb6820ae8
mercurial@4.8.2
4.9
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
mercurial@4.0
4.9
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
mercurial@4.0
4.9
1
hickey/puppet_forge:1.10.0c1148a09ef20
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
i4trust/pdc-portal:2.0.03e77858e1219
mercurial@4.0
4.9
1
jenkinsci/jenkins:2.67a1f33f004659
mercurial@4.0
4.9
1
ladeit/ladeit:latest962b665ffe82
mercurial@4.8.2
4.9
1
leeyoongti/first-app:1.0.021d66cb76352
mercurial@4.0
4.9
1
library/node:16.20f77a1aef2da8
mercurial@4.8.2
4.9
1
library/sonarqube:6.7.6-community0ae5169e3d0f
mercurial@4.0
4.9
1
lsstdm/alert-stream-simulator:v1.2.1973df082d006
mercurial@4.8.2
4.9
1
lsstdm/lsst_alert_packet:tickets-DM-3274374c97a490940
mercurial@4.8.2
4.9
1
lsstsqre/kafkaaggregator:masterbe1b21060854
mercurial@4.8.2
4.9
1
lsstsqre/squash-api:0.5.34879415ec6ac
mercurial@4.8.2
4.9
1
moreillon/api-proxy:2373c1953739ef6956b5
mercurial@4.8.2
4.9
1
moreillon/camera-proxy:latestce60056b50c2
mercurial@4.8.2
4.9
1
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
mercurial@4.0
4.9
1
moreillon/mqtt-logger:9ffbf7180a8a7daf56f6
mercurial@4.8.2
4.9
1
mozilla/sentencecollector:2.0.91da6ff5c4895
mercurial@4.8.2
4.9
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
mercurial@4.0
4.9
1
neilpeterson/aks-helloworld:v1fb47732ef36b
mercurial@4.0
4.9
1
neilpeterson/burst-scheduler:v1.23a8877032972
mercurial@4.0
4.9
1
neilpeterson/chart-tweet:latest64fd8dab075f
mercurial@4.0
4.9
1
neilpeterson/get-tweet:v28b645ac1a23e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-container-instances-demo:latest6527b05d5d03
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-cosmos-mongodb-demo:latestf4940e84ed05
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-mysql-demo:latest5859d68a6c9f
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-storage-demo:latest29d229ab446e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/osba-text-analytics-demo:latest969af3cb8466
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
neilpeterson/process-tweet:latest39ce9f92e899
mercurial@4.0
4.9
1
nmalhotr/webserver:v1.0.03419361fb0dd
mercurial@4.8.2
4.9
1
nodered/node-red-docker:0.19.6-v8070643219ea2
mercurial@4.0
4.9
1
ondrejsika/parking:latestb1fd497416c8
mercurial@4.0
4.9
1
openproject/community:12.0.2734743d11094
mercurial@4.8.2
4.9
1
openwhisk/alarmprovider:2.2.0b695a6ceb406
mercurial@4.0
4.9
1
openwhisk/kafkaprovider:2.1.063dc3d2a0904
mercurial@4.8.2
4.9
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
mercurial@4.0
4.9
1
patdada/bella-docker:v1.0.075127147a624
mercurial@4.8.2
4.9
1
pecan/monitor:1.7.273b2074f3fec
mercurial@4.8.2
4.9
1
plumdog/db-operator:latest0c2fa2db0357
mercurial@4.8.2
4.9
1
rakii8585/angular-node-webapp:latest026082a515ac
mercurial@4.0
4.9
1
raykrueger/riemann:0.2.14c8baf3de57bb
mercurial@4.0
4.9
1
rlex/jsonvisio:1.9.5cd50ff65118e
mercurial@4.8.2
4.9
1
roadiehq/community-backstage-image:latestef355bf5b639
mercurial@4.8.2
4.9
1
robotshop/rs-cart:latest388349d5cb3c
mercurial@4.0
4.9
1
robotshop/rs-catalogue:latestd545747c1b97
mercurial@4.0
4.9
1
robotshop/rs-user:latestea509182c180
mercurial@4.0
4.9
1
royalwang/sentinel-dashboard:1.8.4df99e2499f91
mercurial@4.0
4.9
1
samajh/alprbackend:latestea742b4372ad
mercurial@4.8.2
4.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.