StackRadar

CVE-2020-28500

Medium

Advisory

Published 15 Feb 2021In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.073
94th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
89
of 17,781 indexed, latest versions
Container images
87
deployed by those charts
Fix available
3 of 4
affected packages

Regular Expression Denial of Service (ReDoS) in lodash

Carried by container images the latest versions of 89 of 17,781 indexed charts deploy, on 87 images.

Affected packageAffected versionsFixed inImages
lodashnpm4.17.2, 4.17.4, 4.17.5, 4.17.10+5 more4.17.2184
lodash-esnpm4.17.4, 4.17.15, 4.17.204.17.2113
node-lodashdeb4.17.15+dfsg-24.17.15+dfsg-2ubuntu0.1~esm12
lodash.trimnpm4.5.1no fix listed1
OSV records
GHSA-29mw-wpgm-hmr9UBUNTU-CVE-2020-28500
Also known as
USN-8411-1

Charts affected

89 by stars
ChartLatestAffected imagesRadar Score
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
lodash@4.17.15
4.17.21

Open the chart page →

32,915
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
lodash@4.17.10
4.17.21
ibmcom/bai-setup-dev:19.0.2b8e8df11072d
lodash@4.17.10
4.17.21

Open the chart page →

39,349
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
lodash@4.17.5
4.17.21
ibmcom/microclimate-portal:latested5505e5c7ec
lodash@4.17.5
4.17.21

Open the chart page →

57,669
ibm-voice-gateway-devibm-charts3.1.01 of 2See more

ibm-voice-gateway-dev ibm-charts 3.1.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ibmcom/voice-gateway-mr:1.0.5.00762ab1df6c1
lodash@4.17.15
4.17.21

Open the chart page →

4,505
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
lodash@4.17.20
4.17.21

Open the chart page →

4,944
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
lodash@4.17.15
4.17.21

Open the chart page →

10,494
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21

Open the chart page →

7,232
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
lodash@4.17.4
4.17.21

Open the chart page →

4,614
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
lodash@4.17.15
4.17.21

Open the chart page →

6,454
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
lodash@4.17.15
4.17.21

Open the chart page →

4,185
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
lodash@4.17.19
4.17.21

Open the chart page →

3,397
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
lodash@4.17.15
node-lodash@4.17.15+dfsg-2
4.17.21
4.17.15+dfsg-2ubuntu0.1~esm1

Open the chart page →

17,779
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21

Open the chart page →

7,929
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
lodash@4.17.15
4.17.21

Open the chart page →

3,651
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
lodash@4.17.20
4.17.21

Open the chart page →

6,438
monocularmonocular1.4.151 of 5See more

monocular monocular 1.4.15

1 of the 5 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
lodash@4.17.4
4.17.21

Open the chart page →

7,048
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
lodash@4.17.19
4.17.21

Open the chart page →

6,684
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
lodash@4.17.20
4.17.21

Open the chart page →

27,465
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
openwhisk/alarmprovider:2.2.0b695a6ceb406
lodash@4.17.20
4.17.21

Open the chart page →

36,215
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
lodash@4.17.15
4.17.21

Open the chart page →

5,215
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
lodash@4.17.4
4.17.21

Open the chart page →

3,638
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
lodash@4.17.15
4.17.21

Open the chart page →

3,696
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
lodash@4.17.15
4.17.21

Open the chart page →

29,220
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
lodash@4.17.15
4.17.21

Open the chart page →

29,220
alertmanager-to-alerta-botsomeblackmagic0.2.01 of 1See more

alertmanager-to-alerta-bot someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
lodash@4.17.15
4.17.21

Open the chart page →

2,121
alert-mappersomeblackmagic0.2.01 of 1See more

alert-mapper someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
someblackmagic/alert-mapper:v0.1.088351d85c04c
lodash@4.17.15
4.17.21

Open the chart page →

1,890
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
lodash@4.17.15
4.17.21

Open the chart page →

4,967
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
lodash@4.17.4
4.17.21

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
lodash@4.17.4
4.17.21

Open the chart page →

12,460
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
lodash@4.17.15
node-lodash@4.17.15+dfsg-2
4.17.21
4.17.15+dfsg-2ubuntu0.1~esm1

Open the chart page →

10,902
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
lodash@4.17.15
4.17.21

Open the chart page →

3,827
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
lodash@4.17.11
4.17.21

Open the chart page →

4,017
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
lodash@4.17.20
4.17.21

Open the chart page →

4,661
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
lodash@4.17.11
4.17.21

Open the chart page →

3,576
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
lodash@4.17.19
4.17.21

Open the chart page →

2,838
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
lodash@4.17.20
4.17.21

Open the chart page →

2,559
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
lodash@4.17.20
lodash-es@4.17.20
4.17.21
4.17.21

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
lodash-es@4.17.15
4.17.21

Open the chart page →

22,665
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2020-28500.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
lodash@4.17.20
lodash-es@4.17.15
4.17.21
4.17.21

Open the chart page →

5,806

Container images carrying it

87 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
mozilla/sentencecollector:2.0.91da6ff5c4895
lodash@4.17.19
4.17.21
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
lodash@4.17.20
4.17.21
1
ondrejsika/parking:latestb1fd497416c8
lodash@4.17.15
4.17.21
1
openwhisk/alarmprovider:2.2.0b695a6ceb406
lodash@4.17.20
4.17.21
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
lodash@4.17.15
4.17.21
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
lodash@4.17.11
4.17.21
1
polonel/trudesk:1.2.60cf6513f6fe3
lodash@4.17.11
4.17.21
1
pysga1996/python-redis-web:latestfdeec30ad482
lodash@4.17.20
4.17.21
1
roadiehq/community-backstage-image:latestef355bf5b639
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21
1
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
lodash@4.17.15
4.17.21
1
someblackmagic/alert-mapper:v0.1.088351d85c04c
lodash@4.17.15
4.17.21
1
sqlpad/sqlpad:6.7d3d2f430dffd
lodash@4.17.19
4.17.21
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
lodash@4.17.15
node-lodash@4.17.15+dfsg-2
4.17.21
4.17.15+dfsg-2ubuntu0.1~esm1
1
temporalio/web:1.14.033cfa863d8ce
lodash-es@4.17.15
4.17.21
1
testhubio/testhub-frontend:on-preme86c2db53be8
lodash@4.17.15
4.17.21
1
thelounge/thelounge:4.2.0-alpine639978459c3a
lodash@4.17.20
4.17.21
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
lodash@4.17.4
4.17.21
1
tzahi12345/youtubedl-material:4.23720b856bd2f
lodash@4.17.19
4.17.21
1
ubercadence/web:v3.29.58564a5b44a6d
lodash@4.17.20
lodash-es@4.17.20
4.17.21
4.17.21
1
wekanteam/wekan:v4.2268a51f0327df
lodash@4.17.19
4.17.21
1
willwill/kube-slack:v4.1.1d443017aae98
lodash@4.17.11
4.17.21
1
wiremind/scrapoxy:lateste7048929a676
lodash@4.17.15
4.17.21
1
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
lodash.trim@4.5.1
no fix listed
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
lodash@4.17.13
lodash-es@4.17.15
4.17.21
4.17.21
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
lodash@4.17.15
lodash-es@4.17.15
4.17.21
4.17.21
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
lodash@4.17.19
4.17.21
1
ghcr.io/leoquote/mergeable:latest451706815103
lodash@4.17.20
4.17.21
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
lodash@4.17.20
4.17.21
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
lodash-es@4.17.20
4.17.21
1
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
lodash@4.17.20
4.17.21
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
lodash@4.17.15
4.17.21
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
lodash@4.17.20
4.17.21
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
lodash@4.17.15
4.17.21
1
quay.io/wekan/wekan:v5.65cb17600883a3
lodash@4.17.4
4.17.21
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
lodash@4.17.10
lodash-es@4.17.4
4.17.21
4.17.21
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.