StackRadar

CVE-2019-3902

Medium

Advisory

Published 22 Apr 2019In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.014
71st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
126
of 17,781 indexed, latest versions
Container images
119
deployed by those charts
Fix available
3 of 3
affected packages

Mercurial Path Traversal/Link Following vulnerability

Carried by container images the latest versions of 126 of 17,781 indexed charts deploy, on 119 images.

Affected packageAffected versionsFixed inImages
mercurialpypi3.1.2, 3.7.3, 4.0, 4.8.24.9119
mercurialapk4.8.2-r04.9-r02
mercurialdeb3.1.2-2+deb8u3, 3.1.2-2+deb8u43.1.2-2+deb8u714
OSV records
ALPINE-CVE-2019-3902GHSA-mq66-vcfc-8246DLA-1764-1
Also known as
PYSEC-2019-188

Charts affected

126 by stars
ChartLatestAffected imagesRadar Score
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
mercurial@4.8.2
4.9

Open the chart page →

5,851
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
mercurial@4.8.2
4.9

Open the chart page →

52,919
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
mercurial@4.8.2
4.9

Open the chart page →

8,213
rocketmqgin1.1.01 of 2See more

rocketmq gin 1.1.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.9
3.1.2-2+deb8u7

Open the chart page →

9,154
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
mercurial@4.0
4.9

Open the chart page →

18,517
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
mercurial@4.8.2
4.9

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
mercurial@4.8.2
4.9

Open the chart page →

77,687
gollumgeek-cookbookVerified publisher3.4.21 of 3See more

gollum geek-cookbook 3.4.2

1 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
gollumorg/gollum:latest7cd5305a3cf7
mercurial@4.8.2
4.9

Open the chart page →

4,629
magic-mirrorgeek-cookbookVerified publisher4.4.21 of 1See more

magic-mirror geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
mercurial@4.8.2
4.9

Open the chart page →

4,405
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
mercurial@4.8.2
4.9

Open the chart page →

6,810
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
mercurial@4.0
4.9

Open the chart page →

2,723
Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacionVerified publisher1.0.12 of 6See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

2 of the 6 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
mercurial@4.0
4.9
fjvela/urjc-fjvela-server:1.0.53c840aebce22
mercurial@4.0
4.9

Open the chart page →

19,187
helm-taigamvitale1989-helm-taigaVerified publisher0.2.51 of 2See more

helm-taiga mvitale1989-helm-taiga 0.2.5

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
mercurial@4.0
4.9

Open the chart page →

5,104
sentinel-dashboardsentinel-dashboardVerified publisher0.1.01 of 1See more

sentinel-dashboard sentinel-dashboard 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
royalwang/sentinel-dashboard:1.8.4df99e2499f91
mercurial@4.0
4.9

Open the chart page →

4,287
k8s-appliershlomibendavidOfficialVerified publisher1.0.11 of 1See more

k8s-applier shlomibendavid 1.0.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
shlomibendavid/k8s-applier:0311240529a22ffbe0f04e
mercurial@4.8.2
4.9

Open the chart page →

1,206
statsdstatsd-airflow-smd0.1.191 of 1See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
mercurial@4.0
4.9

Open the chart page →

4,185
angular-node-chartangular-webapp2.0.01 of 1See more

angular-node-chart angular-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
rakii8585/angular-node-webapp:latest026082a515ac
mercurial@4.0
4.9

Open the chart page →

2,616
d.vazquezm.2021_helmapphelmVerified publisher1.0.02 of 6See more

d.vazquezm.2021_helm apphelm 1.0.0

2 of the 6 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
davidvmar/urjc-davidvmar-external-service:1.0.02a68e9ac7f09
mercurial@4.0
4.9
davidvmar/urjc-davidvmar-server:1.0.05663f5b24615
mercurial@4.0
4.9

Open the chart page →

19,745
mongo-uiappscodeVerified publisher2026.3.301 of 1See more

mongo-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ghcr.io/kubedb/mongo-gui:latestee0354b7a57a
mercurial@4.0
4.9

Open the chart page →

912
authorizationassist-iot-authorisation0.1.01 of 2See more

authorization assist-iot-authorisation 0.1.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
assistiot/authorization_svr:latestdb9361dad79b
mercurial@4.8.2
4.9

Open the chart page →

5,537
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
mercurial@4.8.2
4.9

Open the chart page →

77,706
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
mercurial@4.8.2
4.9

Open the chart page →

77,706
webserverazureorkestra1.0.01 of 1See more

webserver azureorkestra 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
nmalhotr/webserver:v1.0.03419361fb0dd
mercurial@4.8.2
4.9

Open the chart page →

3,037
aks-helloworldazure-sample0.1.11 of 1See more

aks-helloworld azure-sample 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/aks-helloworld:v1fb47732ef36b
mercurial@4.0
4.9

Open the chart page →

4,269
azure-voteazure-sample0.1.11 of 2See more

azure-vote azure-sample 0.1.1

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
mercurial@4.0
4.9

Open the chart page →

5,224
azure-vote-osbaazure-sample0.1.01 of 1See more

azure-vote-osba azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
mercurial@4.0
4.9

Open the chart page →

4,269
burst-schedulerazure-sample0.1.01 of 1See more

burst-scheduler azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/burst-scheduler:v1.23a8877032972
mercurial@4.0
4.9

Open the chart page →

2,408
osba-container-instances-demoazure-sample0.1.01 of 1See more

osba-container-instances-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/osba-container-instances-demo:latest6527b05d5d03
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,212
osba-cosmos-mongodb-demoazure-sample0.1.01 of 1See more

osba-cosmos-mongodb-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/osba-cosmos-mongodb-demo:latestf4940e84ed05
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

2,904
osba-mysql-demoazure-sample0.1.01 of 1See more

osba-mysql-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/osba-mysql-demo:latest5859d68a6c9f
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

2,895
osba-storage-demoazure-sample0.1.01 of 1See more

osba-storage-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/osba-storage-demo:latest29d229ab446e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,425
osba-text-analytics-demoazure-sample0.1.01 of 1See more

osba-text-analytics-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/osba-text-analytics-demo:latest969af3cb8466
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

3,089
twitter-sentimentazure-sample0.1.03 of 3See more

twitter-sentiment azure-sample 0.1.0

3 of the 3 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
neilpeterson/chart-tweet:latest64fd8dab075f
mercurial@4.0
4.9
neilpeterson/get-tweet:v28b645ac1a23e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
neilpeterson/process-tweet:latest39ce9f92e899
mercurial@4.0
4.9

Open the chart page →

11,833
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
mercurial@4.8.2
4.9

Open the chart page →

4,455
honeywell-exporterbryanalves0.1.11 of 1See more

honeywell-exporter bryanalves 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
mercurial@4.0
4.9

Open the chart page →

5,437
smart-exporterbryanalves0.2.21 of 1See more

smart-exporter bryanalves 0.2.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
bryanalves/smart_exporter:0.2af47dfbb9413
mercurial@4.0
4.9

Open the chart page →

4,131
bucket-clonercamptocamp31.0.41 of 1See more

bucket-cloner camptocamp3 1.0.4

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
camptocamp/bucket-cloner:latestacfafc308d88
mercurial@4.8.2
4.9

Open the chart page →

4,518
ekorrecamptocamp30.1.11 of 1See more

ekorre camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
camptocamp/ekorre:0.1.035c91d5fda04
mercurial@4.8.2
4.9

Open the chart page →

3,891
imap-mailbox-exportercamptocamp32.0.01 of 1See more

imap-mailbox-exporter camptocamp3 2.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
camptocamp/imap-mailbox-exporter:latest9dec019e4c62
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.9
3.1.2-2+deb8u7

Open the chart page →

2,234
ldap-search-exportercamptocamp31.0.01 of 1See more

ldap-search-exporter camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
camptocamp/ldap-search-exporter:latest5e55370dd292
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.9
3.1.2-2+deb8u7

Open the chart page →

2,234
tsaascetic0.1.51 of 1See more

tsaas cetic 0.1.5

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
ceticasbl/tsimulus-saas:0.1.18bc34ce180d0c
mercurial@4.8.2
4.9

Open the chart page →

1,653
gocdcloudnativeapp1.9.22 of 2See more

gocd cloudnativeapp 1.9.2

2 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
gocd/gocd-agent-alpine-3.9:v19.3.053588bd3221f
mercurial@4.8.2-r0
mercurial@4.8.2
4.9-r0
4.9
gocd/gocd-server:v19.3.02da45cb09d57
mercurial@4.8.2-r0
mercurial@4.8.2
4.9-r0
4.9

Open the chart page →

9,144
node-redcloudnativeapp1.2.21 of 1See more

node-red cloudnativeapp 1.2.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
nodered/node-red-docker:0.19.6-v8070643219ea2
mercurial@4.0
4.9

Open the chart page →

4,790
puppet-forgecloudnativeapp0.1.81 of 2See more

puppet-forge cloudnativeapp 0.1.8

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
hickey/puppet_forge:1.10.0c1148a09ef20
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7

Open the chart page →

4,086
riemanncloudnativeapp0.1.21 of 1See more

riemann cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
raykrueger/riemann:0.2.14c8baf3de57bb
mercurial@4.0
4.9

Open the chart page →

6,497
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
mercurial@4.0
4.9

Open the chart page →

5,060
robot-shopcloud-native-toolkit1.1.13 of 12See more

robot-shop cloud-native-toolkit 1.1.1

3 of the 12 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
robotshop/rs-cart:latest388349d5cb3c
mercurial@4.0
4.9
robotshop/rs-catalogue:latestd545747c1b97
mercurial@4.0
4.9
robotshop/rs-user:latestea509182c180
mercurial@4.0
4.9

Open the chart page →

29,555
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
mercurial@3.7.3
4.9

Open the chart page →

70,895
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
mercurial@4.0
4.9

Open the chart page →

8,245
db-operatordb-operatorVerified publisher0.1.01 of 1See more

db-operator db-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-3902.

Container imageDigestPackageFixed in
plumdog/db-operator:latest0c2fa2db0357
mercurial@4.8.2
4.9

Open the chart page →

3,042

Container images carrying it

119 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
samajh/alprfrontend:latest05ef4fddbb75
mercurial@4.8.2
4.9
1
shlomibendavid/k8s-applier:0311240529a22ffbe0f04e
mercurial@4.8.2
4.9
1
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
mercurial@4.0
4.9
1
slagattollas/server-practica:latest6dd8ead8e2b1
mercurial@4.0
4.9
1
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.9
3.1.2-2+deb8u7
1
stremio/server:latest3dc145603def
mercurial@4.8.2
4.9
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
mercurial@4.8.2
4.9
1
weblate/weblate:3.11.3-182848df56ecd
mercurial@4.8.2
4.9
1
zohardocker12/weather_app_flask:latestb86d60dbb68d
mercurial@4.8.2
4.9
1
ghcr.io/grofers/legend:0.1d6e901ad0ebd
mercurial@4.8.2
4.9
1
ghcr.io/kubedb/mongo-gui:latestee0354b7a57a
mercurial@4.0
4.9
1
ghcr.io/leoquote/mergeable:latest451706815103
mercurial@4.0
4.9
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
mercurial@4.0
4.9
1
ghcr.io/privacyengineering/collector-go:main7217f1a4fa28
mercurial@4.8.2
4.9
1
ghcr.io/privacyengineering/consumer:main73f59c032812
mercurial@4.8.2
4.9
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
mercurial@4.8.2
4.9
1
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
mercurial@4.0
4.9
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
mercurial@4.8.2
4.9
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
mercurial@4.8.2
4.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.