StackRadarChart IndexLive demo

CVE-2020-28472

High

Advisory

Published 16 Nov 2021In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.3; base score, highest
EPSS: 0.021; 81st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 10; of 17,781 indexed, latest versions
Container images: 8; deployed by those charts
Fix available: 2 of 2; affected packages

Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 8 images.

Affected package	Affected versions	Fixed in	Images
aws-sdknpm	2.57.0, 2.171.0, 2.628.0, 2.667.0+2 more	2.814.0	7
@aws-sdk/shared-ini-file-loadernpm	0.1.0-preview.3	1.0.0-rc.9	1

OSV records: GHSA-rrc9-gqf8-8rwg

Charts affected

10 by stars

Chart

Latest

Affected images

Radar Score

wikijsgeek-cookbook

1 of 1 See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	aws-sdk@2.778.0	2.814.0

Open the chart page →

5,946

scrapoxywiremind

1 of 1 See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
wiremind/scrapoxy :latest	e7048929a676	aws-sdk@2.171.0	2.814.0

Open the chart page →

2,154

haste-servergeek-cookbook

1 of 1 See more

haste-server geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	aws-sdk@2.738.0	2.814.0

Open the chart page →

10,994

wikijshomeenterpriseinc

1 of 1 See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
requarks/wiki :canary-2.5.243	8b5865a7386c	aws-sdk@2.778.0	2.814.0

Open the chart page →

4,253

monocularjenkins-x

1 of 4 See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
migmartri/prerender :latest	486aacfd5aa9	aws-sdk@2.57.0	2.814.0

Open the chart page →

4,614

monocularmonocular

1 of 5 See more

monocular monocular 1.4.15

1 of the 5 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
migmartri/prerender :latest	486aacfd5aa9	aws-sdk@2.57.0	2.814.0

Open the chart page →

7,048

codimdphntom

1 of 3 See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
phntom/codimd :2.4.3	1b9aafbb62e6	@aws-sdk/shared-ini-file-loader@0.1.0-preview.3	1.0.0-rc.9

Open the chart page →

6,524

logsmo-helm-chart

1 of 6 See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	aws-sdk@2.667.0	2.814.0

Open the chart page →

29,220

pombasmo-helm-chart

1 of 17 See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	aws-sdk@2.667.0	2.814.0

Open the chart page →

29,220

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2020-28472.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	aws-sdk@2.628.0	2.814.0

Open the chart page →

2,838

Container images carrying it

8 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
migmartri/prerender :latest	486aacfd5aa9	aws-sdk@2.57.0	2.814.0	2
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	aws-sdk@2.667.0	2.814.0	2
phntom/codimd :2.4.3	1b9aafbb62e6	@aws-sdk/shared-ini-file-loader@0.1.0-preview.3	1.0.0-rc.9	1
requarks/wiki :canary-2.5.243	8b5865a7386c	aws-sdk@2.778.0	2.814.0	1
wiremind/scrapoxy :latest	e7048929a676	aws-sdk@2.171.0	2.814.0	1
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	aws-sdk@2.628.0	2.814.0	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	aws-sdk@2.738.0	2.814.0	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	aws-sdk@2.778.0	2.814.0	1