StackRadar

CVE-2020-7774

Critical

Advisory

Published 17 Nov 2020In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.694
99th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
122
of 17,781 indexed, latest versions
Container images
124
deployed by those charts
Fix available
2 of 3
affected packages

Prototype Pollution in y18n

Carried by container images the latest versions of 122 of 17,781 indexed charts deploy, on 124 images.

Affected packageAffected versionsFixed inImages
nodejsapk10.16.3-r0, 12.17.0-r0, 12.18.4-r0, 12.20.1-r010.24.1-r0, 12.22.1-r05
y18nnpm3.2.1, 4.0.03.2.2, 4.0.1122
node-y18ndeb4.0.0-2no fix listed2
OSV records
ALPINE-CVE-2020-7774GHSA-c4w7-xm78-47vhUBUNTU-CVE-2020-7774

Charts affected

122 by stars
ChartLatestAffected imagesRadar Score
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
y18n@4.0.0
4.0.1

Open the chart page →

12,791
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
y18n@4.0.0
4.0.1

Open the chart page →

109,294
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
y18n@4.0.0
4.0.1

Open the chart page →

27,465
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
y18n@3.2.1
3.2.2

Open the chart page →

88,546
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
y18n@3.2.1
3.2.2

Open the chart page →

38,865
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
openwhisk/alarmprovider:2.2.0b695a6ceb406
y18n@3.2.1
3.2.2

Open the chart page →

36,215
hive-selfservice-ui-nodeory0.1.01 of 1See more

hive-selfservice-ui-node ory 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
oryd/hive-selfservice-ui-node:v0.0.426347ef0a2de
y18n@3.2.1
3.2.2

Open the chart page →

1,986
myappp4-helm0.1.02 of 6See more

myapp p4-helm 0.1.0

2 of the 6 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
y18n@3.2.1
3.2.2
fjvela/urjc-fjvela-server:1.0.53c840aebce22
y18n@3.2.1
3.2.2

Open the chart page →

19,720
practica-helmpractica-helm0.1.02 of 7See more

practica-helm practica-helm 0.1.0

2 of the 7 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
slagattollas/server-practica:latest6dd8ead8e2b1
y18n@4.0.0
4.0.1
slagattollas/weatherservice-practica:latest68e7f56393fc
y18n@3.2.1
3.2.2

Open the chart page →

28,484
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
istio/examples-bookinfo-ratings-v1:1.14.0eb0f1a725ca8
y18n@4.0.0
4.0.1

Open the chart page →

20,462
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
istio/examples-bookinfo-ratings-v1:1.14.0eb0f1a725ca8
y18n@4.0.0
4.0.1

Open the chart page →

20,462
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
y18n@4.0.0
4.0.1

Open the chart page →

5,215
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
y18n@3.2.1
3.2.2

Open the chart page →

5,582
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
y18n@4.0.0
4.0.1

Open the chart page →

3,696
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
y18n@4.0.0
4.0.1

Open the chart page →

29,220
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
y18n@4.0.0
4.0.1

Open the chart page →

29,220
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
y18n@4.0.0
4.0.1

Open the chart page →

2,460
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
y18n@3.2.1
3.2.2

Open the chart page →

4,967
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
node-y18n@4.0.0-2
y18n@4.0.0
no fix listed
4.0.1

Open the chart page →

10,902
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
y18n@4.0.0
4.0.1

Open the chart page →

3,827
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
y18n@4.0.0
4.0.1

Open the chart page →

2,838
helloworldyotron-helm-charts0.1.01 of 1See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-7774.

Container imageDigestPackageFixed in
a5hut0sh/helloworld:1.02ae77620e616
y18n@3.2.1
3.2.2

Open the chart page →

1,309

Container images carrying it

124 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
mojaloop/event-sidecar:v11.0.189b8ab71b74b
y18n@3.2.1
3.2.2
5
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
y18n@3.2.1
3.2.2
4
hyperledger/fabric-couchdb:0.4.15f6c724592abf
y18n@3.2.1
3.2.2
4
oscarsotosanchez/server:v1.06e2e1279126b
y18n@4.0.0
4.0.1
4
oscarsotosanchez/weatherservice:v1.0911ec961d10b
y18n@3.2.1
3.2.2
4
frankescobar/allure-docker-service-ui:7.0.3:latest4ebd8b4ef340
y18n@3.2.1
3.2.2
3
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
y18n@4.0.0
4.0.1
3
pantsel/konga:latestc8172b75607d
y18n@3.2.1
3.2.2
3
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
y18n@3.2.1
3.2.2
2
fjvela/urjc-fjvela-server:1.0.53c840aebce22
y18n@3.2.1
3.2.2
2
governify/assets-manager:v1.4.12987672448c7
y18n@4.0.0
4.0.1
2
governify/director:v1.4.0608c6940bb98
y18n@4.0.0
4.0.1
2
governify/registry:v3.4.0d3f37f4f8168
y18n@4.0.0
4.0.1
2
governify/render:v2.2.0daeca1ce28e6
y18n@4.0.0
4.0.1
2
governify/reporter:v2.2.038595913458f
y18n@4.0.0
4.0.1
2
gradiant/open5gs-webui:2.7.5fbd10c017541
y18n@3.2.1
3.2.2
2
istio/examples-bookinfo-ratings-v1:1.15.009b9d6958a13
y18n@3.2.1
3.2.2
2
istio/examples-bookinfo-ratings-v1:1.14.0eb0f1a725ca8
y18n@4.0.0
4.0.1
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
y18n@4.0.0
4.0.1
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
y18n@4.0.0
4.0.1
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
y18n@3.2.1
3.2.2
2
statsd/statsd:v0.8.6dab129e74c25
y18n@4.0.0
4.0.1
2
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
y18n@4.0.0
4.0.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
y18n@4.0.0
4.0.1
2
a5hut0sh/helloworld:1.02ae77620e616
y18n@3.2.1
3.2.2
1
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
y18n@3.2.1
3.2.2
1
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
y18n@3.2.1
3.2.2
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
y18n@3.2.1
3.2.2
1
aureliengasser/http-folder:1.1.111c4318c2571
y18n@3.2.1
3.2.2
1
billimek/node-influx-uptimerobot:latest5814f0bcf5ba
y18n@4.0.0
4.0.1
1
cnieg/maildev:v1.1.998ee05668915
y18n@4.0.0
4.0.1
1
conduction/conduction-ui-app:devd591f5e6f2a9
y18n@4.0.0
4.0.1
1
daskdev/dask-notebook:1.1.0052630f5ca04
y18n@4.0.0
4.0.1
1
datarhei/restreamer:0.6.4655e12f9eeed
y18n@4.0.0
4.0.1
1
davidvmar/urjc-davidvmar-external-service:1.0.02a68e9ac7f09
y18n@4.0.0
4.0.1
1
davidvmar/urjc-davidvmar-server:1.0.05663f5b24615
y18n@4.0.0
4.0.1
1
decayofmind/hubot:3.3.21e18e92fe694
y18n@4.0.0
4.0.1
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
y18n@4.0.0
4.0.1
1
devspacecloud/ui:0.3.3deef55ff29a7
y18n@4.0.0
4.0.1
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
y18n@3.2.1
3.2.2
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
y18n@4.0.0
4.0.1
1
ethersphere/bzz-token-service:latest7624f11a72ad
y18n@4.0.0
4.0.1
1
fiware/iotagent-ul:1.14.0fe11f55a926d
y18n@3.2.1
3.2.2
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
y18n@4.0.0
4.0.1
1
galaxy/galaxy-init:v18.010267bad550e6
y18n@3.2.1
3.2.2
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
nodejs@12.17.0-r0
y18n@4.0.0
12.22.1-r0
4.0.1
1
gristlabs/grist:0.7.96e71b1914a7e
y18n@4.0.0
4.0.1
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
y18n@4.0.0
4.0.1
1
halkeye/hubot:latest9764d2202130
y18n@4.0.0
4.0.1
1
halkeye/irslackd:latest7638bfba70b0
y18n@3.2.1
3.2.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.