StackRadarChart IndexLive demo

CVE-2020-28502

Critical

Advisory

Published 4 May 2021In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.046; 91st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 18; deployed by those charts
Fix available: 2 of 2; affected packages

xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 18 images.

Affected package	Affected versions	Fixed in	Images
xmlhttprequest-sslnpm	1.5.1, 1.5.3, 1.5.5	1.6.2	17
xmlhttprequestnpm	1.5.0	1.7.0	1

OSV records: GHSA-h4j5-c7cj-74xg

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

graphql-hivegraphql-hive

1 of 17 See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

10,311

kongakonga

1 of 1 See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	xmlhttprequest-ssl@1.5.3	1.6.2

Open the chart page →

5,209

restreamerutkuozdemir

1 of 1 See more

restreamer utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
datarhei/restreamer :0.6.4	655e12f9eeed	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,598

scrapoxywiremind

1 of 1 See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
wiremind/scrapoxy :latest	e7048929a676	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,154

openhab-cloudandibraeu

1 of 1 See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
openhab/openhab-cloud :a8138a3	29dd2bac8c4b	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

3,437

angular-chartangular-application

1 of 1 See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

3,237

openapiassist-iot-open-api-management

1 of 6 See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	xmlhttprequest-ssl@1.5.3	1.6.2

Open the chart page →

18,277

registry-uibryanalves

1 of 1 See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
konradkleine/docker-registry-frontend :v2	181aad54ee64	xmlhttprequest-ssl@1.5.3	1.6.2

Open the chart page →

4,069

1 of 1 See more

maildev cnieg 1.1.1

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
cnieg/maildev :v1.1.9	98ee05668915	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,449

kongacreate-databases

1 of 1 See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	xmlhttprequest-ssl@1.5.3	1.6.2

Open the chart page →

5,209

backend-servicedev-krishan-dhaka-charts

1 of 1 See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
devkrishan001/backend :latest	f1c3acadeabe	xmlhttprequest@1.5.0	1.7.0

Open the chart page →

1,264

nightscoutgeek-cookbook

1 of 1 See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
nightscout/cgm-remote-monitor :14.2.5	00c3b4833f1b	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

4,043

theloungegeek-cookbook

1 of 1 See more

thelounge geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
thelounge/thelounge :4.2.0-alpine	639978459c3a	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,689

hive-appgraphql-hive

1 of 1 See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,682

hive-appgraphql-hive-subcharts

1 of 1 See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

2,682

ibm-microclimateibm-charts

2 of 8 See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	xmlhttprequest-ssl@1.5.5	1.6.2
ibmcom/microclimate-portal :latest	ed5505e5c7ec	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

57,669

cloudshellinseefrlab

1 of 2 See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
inseefrlab/shelly :cloudshell	31f04ca7436b	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

10,494

yapijoelee2012

1 of 1 See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
jayfong/yapi :1.10.2	163e5d621910	xmlhttprequest-ssl@1.5.3	1.6.2

Open the chart page →

6,454

example-dev-toolsnoygal

2 of 3 See more

example-dev-tools noygal 0.2.8

2 of the 3 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
linuxserver/cloud9 :latest	45c5fe102ff3	xmlhttprequest-ssl@1.5.1	1.6.2
linuxserver/codimd :latest	b801bbcf6386	xmlhttprequest-ssl@1.5.5	1.6.2

Open the chart page →

27,465

1 of 1 See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-28502.

Container image	Digest	Package	Fixed in
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	xmlhttprequest-ssl@1.5.1	1.6.2

Open the chart page →

3,827

Container images carrying it

18 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
pantsel/konga :latest	c8172b75607d	xmlhttprequest-ssl@1.5.3	1.6.2	3
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	xmlhttprequest-ssl@1.5.5	1.6.2	3
cnieg/maildev :v1.1.9	98ee05668915	xmlhttprequest-ssl@1.5.5	1.6.2	1
datarhei/restreamer :0.6.4	655e12f9eeed	xmlhttprequest-ssl@1.5.5	1.6.2	1
devkrishan001/backend :latest	f1c3acadeabe	xmlhttprequest@1.5.0	1.7.0	1
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	xmlhttprequest-ssl@1.5.5	1.6.2	1
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	xmlhttprequest-ssl@1.5.5	1.6.2	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	xmlhttprequest-ssl@1.5.5	1.6.2	1
inseefrlab/shelly :cloudshell	31f04ca7436b	xmlhttprequest-ssl@1.5.5	1.6.2	1
jayfong/yapi :1.10.2	163e5d621910	xmlhttprequest-ssl@1.5.3	1.6.2	1
konradkleine/docker-registry-frontend :v2	181aad54ee64	xmlhttprequest-ssl@1.5.3	1.6.2	1
linuxserver/cloud9 :latest	45c5fe102ff3	xmlhttprequest-ssl@1.5.1	1.6.2	1
linuxserver/codimd :latest	b801bbcf6386	xmlhttprequest-ssl@1.5.5	1.6.2	1
nightscout/cgm-remote-monitor :14.2.5	00c3b4833f1b	xmlhttprequest-ssl@1.5.5	1.6.2	1
openhab/openhab-cloud :a8138a3	29dd2bac8c4b	xmlhttprequest-ssl@1.5.5	1.6.2	1
thelounge/thelounge :4.2.0-alpine	639978459c3a	xmlhttprequest-ssl@1.5.5	1.6.2	1
wiremind/scrapoxy :latest	e7048929a676	xmlhttprequest-ssl@1.5.5	1.6.2	1
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	xmlhttprequest-ssl@1.5.1	1.6.2	1