StackRadar

CVE-2021-23358

Critical

Advisory

Published 29 Mar 2021In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.041
90th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
56
of 17,781 indexed, latest versions
Container images
54
deployed by those charts
Fix available
2 of 2
affected packages

Arbitrary Code Execution in underscore

Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 54 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.4.4, 1.5.2, 1.6.0, 1.7.0+6 more1.12.154
underscoredeb1.7.0~dfsg-1ubuntu1, 1.8.3~dfsg-11.7.0~dfsg-1ubuntu1.1, 1.8.3~dfsg-1ubuntu0.12
OSV records
GHSA-cf4h-3jhx-xvhqUBUNTU-CVE-2021-23358
Also known as
USN-4913-1

Charts affected

56 by stars
ChartLatestAffected imagesRadar Score
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
underscore@1.7.0
1.12.1

Open the chart page →

10,732
netris-controllernetrisai2.8.22 of 14See more

netris-controller netrisai 2.8.2

2 of the 14 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.12.1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
underscore@1.8.3
1.12.1

Open the chart page →

30,326
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.12.1

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
underscore@1.6.0
1.12.1

Open the chart page →

5,946
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
underscore@1.5.2
1.12.1

Open the chart page →

3,795
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
underscore@1.7.0
1.12.1

Open the chart page →

96,941
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
underscore@1.4.4
1.12.1

Open the chart page →

3,476
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.12.1

Open the chart page →

5,209
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
underscore@1.12.0
1.12.1

Open the chart page →

2,519
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
underscore@1.7.0
1.12.1

Open the chart page →

4,260
statsdstatsd-airflow-smd0.1.191 of 1See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.12.1

Open the chart page →

4,185
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
underscore@1.6.0
1.12.1

Open the chart page →

3,833
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
underscore@1.7.0
1.12.1

Open the chart page →

3,437
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.12.1

Open the chart page →

18,277
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
underscore@1.7.0
1.12.1

Open the chart page →

4,069
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
underscore@1.7.0
1.12.1

Open the chart page →

4,083
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
openthread/otbr:latestf307f59f6432
underscore@1.8.3
1.12.1

Open the chart page →

12,779
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
underscore@1.9.1
1.12.1

Open the chart page →

29,901
ethereumcloudnativeapp1.0.01 of 3See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
underscore@1.7.0
underscore@1.7.0~dfsg-1ubuntu1
1.12.1
1.7.0~dfsg-1ubuntu1.1

Open the chart page →

27,417
hubotcloudnativeapp0.0.11 of 1See more

hubot cloudnativeapp 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
minddocdev/hubot:0.1.96c60b11a4fa7
underscore@1.8.3
1.12.1

Open the chart page →

2,580
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
underscore@1.7.0
1.12.1

Open the chart page →

25,456
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.12.1

Open the chart page →

5,209
swagger-combine-uicryptexlabsVerified publisher0.2.41 of 1See more

swagger-combine-ui cryptexlabs 0.2.4

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
underscore@1.7.0
1.12.1

Open the chart page →

1,378
testnet-faucetethereum-helm-chartsVerified publisher0.1.31 of 1See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
parithoshj/testnet-faucet:9859e0dcdca426fea6d
underscore@1.8.3
1.12.1

Open the chart page →

3,005
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
underscore@1.9.1
1.12.1

Open the chart page →

3,260
iotagent-ulfiware0.1.21 of 1See more

iotagent-ul fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
fiware/iotagent-ul:1.14.0fe11f55a926d
underscore@1.9.1
1.12.1

Open the chart page →

3,337
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
underscore@1.7.0
1.12.1

Open the chart page →

3,159
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
underscore@1.7.0
1.12.1

Open the chart page →

5,941
shinobigeek-cookbookVerified publisher1.2.21 of 1See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
shinobisystems/shinobi:dev3ca746937856
underscore@1.4.4
1.12.1

Open the chart page →

4,591
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
underscore@1.7.0
1.12.1

Open the chart page →

9,019
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
governify/collector-dynamic:v1.3.06d3d1a5b46a9
underscore@1.4.4
1.12.1

Open the chart page →

24,319
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
underscore@1.9.2
1.12.1

Open the chart page →

3,003
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
underscore@1.7.0
1.12.1

Open the chart page →

24,161
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
underscore@1.4.4
1.12.1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
underscore@1.4.4
1.12.1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
underscore@1.4.4
1.12.1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
underscore@1.4.4
1.12.1

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.12.1

Open the chart page →

8,213
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
underscore@1.8.3
1.12.1

Open the chart page →

4,253
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
underscore@1.7.0
1.12.1

Open the chart page →

39,349
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
underscore@1.7.0
1.12.1

Open the chart page →

57,669
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
underscore@1.9.1
1.12.1

Open the chart page →

4,944
interbtc-hydrainterlay0.1.151 of 4See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
underscore@1.6.0
1.12.1

Open the chart page →

6,831
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.12.1

Open the chart page →

4,614
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
underscore@1.8.3
1.12.1

Open the chart page →

6,454
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
underscore@1.4.4
1.12.1

Open the chart page →

4,667
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.12.1

Open the chart page →

4,185
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.12.1

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.12.1

Open the chart page →

7,027
monocularmonocular1.4.152 of 5See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.12.1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
underscore@1.6.0
1.12.1

Open the chart page →

7,048
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
underscore@1.8.3
1.12.1

Open the chart page →

4,960
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
underscore@1.8.3
1.12.1

Open the chart page →

27,465
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
underscore@1.8.3
underscore@1.8.3~dfsg-1
1.12.1
1.8.3~dfsg-1ubuntu0.1

Open the chart page →

36,215

Container images carrying it

54 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
underscore@1.6.0
1.12.1
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
underscore@1.7.0
1.12.1
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
underscore@1.5.2
1.12.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
underscore@1.9.1
1.12.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.