StackRadarChart IndexLive demo

CVE-2020-7774

Critical

Advisory

Published 17 Nov 2020In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.694; 99th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 122; of 17,781 indexed, latest versions
Container images: 124; deployed by those charts
Fix available: 2 of 3; affected packages

Prototype Pollution in y18n

Carried by container images the latest versions of 122 of 17,781 indexed charts deploy, on 124 images.

Affected package	Affected versions	Fixed in	Images
nodejsapk	10.16.3-r0, 12.17.0-r0, 12.18.4-r0, 12.20.1-r0	10.24.1-r0, 12.22.1-r0	5
y18nnpm	3.2.1, 4.0.0	3.2.2, 4.0.1	122
node-y18ndeb	4.0.0-2	no fix listed	2

OSV records: ALPINE-CVE-2020-7774 GHSA-c4w7-xm78-47vh UBUNTU-CVE-2020-7774

Charts affected

122 by stars

Chart

Latest

Affected images

Radar Score

danbooru-stackmy0n

1 of 4 See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	y18n@4.0.0	4.0.1

Open the chart page →

12,791

1 of 23 See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	y18n@4.0.0	4.0.1

Open the chart page →

109,294

example-dev-toolsnoygal

1 of 3 See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
linuxserver/codimd :latest	b801bbcf6386	y18n@4.0.0	4.0.1

Open the chart page →

27,465

comacopencord

1 of 9 See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
omecproject/onos-progran :1.0.0	5715e5648aa0	y18n@3.2.1	3.2.2

Open the chart page →

88,546

onos-progranopencord

1 of 2 See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
muluder/prograncontrollermcord :0.1.8	43b597a93da7	y18n@3.2.1	3.2.2

Open the chart page →

38,865

openwhiskopenwhisk

1 of 10 See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
openwhisk/alarmprovider :2.2.0	b695a6ceb406	y18n@3.2.1	3.2.2

Open the chart page →

36,215

hive-selfservice-ui-nodeory

1 of 1 See more

hive-selfservice-ui-node ory 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
oryd/hive-selfservice-ui-node :v0.0.4	26347ef0a2de	y18n@3.2.1	3.2.2

Open the chart page →

1,986

myappp4-helm

2 of 6 See more

myapp p4-helm 0.1.0

2 of the 6 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
fjvela/urjc-fjvela-external-service :1.0.1	a8ebe5ca13fc	y18n@3.2.1	3.2.2
fjvela/urjc-fjvela-server :1.0.5	3c840aebce22	y18n@3.2.1	3.2.2

Open the chart page →

19,720

practica-helmpractica-helm

2 of 7 See more

practica-helm practica-helm 0.1.0

2 of the 7 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
slagattollas/server-practica :latest	6dd8ead8e2b1	y18n@4.0.0	4.0.1
slagattollas/weatherservice-practica :latest	68e7f56393fc	y18n@3.2.1	3.2.2

Open the chart page →

28,484

1 of 7 See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
istio/examples-bookinfo-ratings-v1 :1.14.0	eb0f1a725ca8	y18n@4.0.0	4.0.1

Open the chart page →

20,462

istio-bookinforgnu

1 of 7 See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
istio/examples-bookinfo-ratings-v1 :1.14.0	eb0f1a725ca8	y18n@4.0.0	4.0.1

Open the chart page →

20,462

1 of 1 See more

5,215

unifi-protectschichtel

1 of 1 See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
markdegroot/unifi-protect-arm64 :latest	d8445f2a0de6	y18n@3.2.1	3.2.2

Open the chart page →

5,582

parkingsikalabs

1 of 1 See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
ondrejsika/parking :latest	b1fd497416c8	y18n@4.0.0	4.0.1

Open the chart page →

3,696

logsmo-helm-chart

1 of 6 See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	y18n@4.0.0	4.0.1

Open the chart page →

29,220

pombasmo-helm-chart

1 of 17 See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	y18n@4.0.0	4.0.1

Open the chart page →

29,220

speedtest-trackersoblivionscall

1 of 1 See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
henrywhitaker3/speedtest-tracker :latest	47159a940229	y18n@4.0.0	4.0.1

Open the chart page →

2,460

pachydermstatcan

1 of 4 See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	y18n@3.2.1	3.2.2

Open the chart page →

4,967

grafanasvtech-public-helm-charts

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-y18n@4.0.0-2 y18n@4.0.0	no fix listed 4.0.1

Open the chart page →

10,902

1 of 1 See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	y18n@4.0.0	4.0.1

Open the chart page →

3,827

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	y18n@4.0.0	4.0.1

Open the chart page →

2,838

helloworldyotron-helm-charts

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	y18n@3.2.1	3.2.2

Open the chart page →

1,309

Container images carrying it

124 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
willwill/kube-slack :v4.1.1	d443017aae98	y18n@4.0.0	4.0.1	1
wiremind/scrapoxy :latest	e7048929a676	y18n@3.2.1	3.2.2	1
zooz/predator :1.6	f491d1f7a865	y18n@4.0.0	4.0.1	1
gcr.io/google-samples/microservices-demo/currencyservice :v0.2.3	49d458a3650f	y18n@4.0.0	4.0.1	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	y18n@4.0.0	4.0.1	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	y18n@4.0.0	4.0.1	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	y18n@4.0.0	4.0.1	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	y18n@4.0.0	4.0.1	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	y18n@4.0.0	4.0.1	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	y18n@4.0.0	4.0.1	1
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	y18n@4.0.0	4.0.1	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	y18n@4.0.0	4.0.1	1
ghcr.io/leoquote/mergeable :latest	451706815103	y18n@3.2.1	3.2.2	1
ghcr.io/mario-f/kubevis :v1.4.0	763daf9caf8e	y18n@3.2.1	3.2.2	1
ghcr.io/mmontes11/iot-back :v3.11.0	96683c54ae65	y18n@4.0.0	4.0.1	1
ghcr.io/mmontes11/iot-biot :v3.11.0	33f7976b26a8	y18n@4.0.0	4.0.1	1
ghcr.io/mmontes11/iot-thing :v3.11.0	542e91e8499c	y18n@4.0.0	4.0.1	1
ghcr.io/mmontes11/iot-worker :v3.11.0	491bb243f555	y18n@4.0.0	4.0.1	1
quay.io/ctrontesting/iofog-controller :latest	10df27bc5560	y18n@4.0.0	4.0.1	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	y18n@4.0.0	4.0.1	1
quay.io/ibmgaragecloud/nodejs :latest	01c3b7acb301	y18n@4.0.0	4.0.1	1
quay.io/mongodb/farm-intro-frontend :0.1	99ccdfd543e1	y18n@4.0.0	4.0.1	1
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	y18n@4.0.0	4.0.1	1
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	y18n@3.2.1	3.2.2	1