StackRadarChart IndexLive demo

CVE-2021-23406

High

Advisory

Published 2 Sept 2021In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.029; 86th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 17; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 2 of 2; affected packages

Code Injection in pac-resolver

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
degeneratornpm	1.0.4, 2.2.0	3.0.1	14
pac-resolvernpm	2.0.0, 3.0.0, 4.1.0, 4.2.0	5.0.0	14

OSV records: GHSA-9j49-mfvp-vmhm

Charts affected

17 by stars

Chart

Latest

Affected images

Radar Score

code-serverdeploy-code-server

1 of 2 See more

code-server deploy-code-server 1.0.3

1 of the 2 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
codercom/code-server :3.10.2	47605610ad8d	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0

Open the chart page →

4,577

kongakonga

1 of 1 See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

5,209

ranetogabisonfire

1 of 1 See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/raneto :version-0.16.6	ef768f3df5d0	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

2,519

ghostgeek-cookbook

1 of 1 See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
library/ghost :4.37.0	767230c0f263	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

4,260

openapiassist-iot-open-api-management

1 of 6 See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

18,277

kongacreate-databases

1 of 1 See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

5,209

iotagent-ulfiware

1 of 1 See more

iotagent-ul fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
fiware/iotagent-ul :1.14.0	fe11f55a926d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

3,337

shinobigeek-cookbook

1 of 1 See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
shinobisystems/shinobi :dev	3ca746937856	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0

Open the chart page →

4,591

Governify-Bluejaygovernify

1 of 12 See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
governify/registry :v3.4.0	d3f37f4f8168	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

22,512

Governify-Falcongovernify

1 of 10 See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
governify/registry :v3.4.0	d3f37f4f8168	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

24,319

ibm-microclimateibm-charts

1 of 8 See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-portal :latest	ed5505e5c7ec	degenerator@1.0.4 pac-resolver@2.0.0	3.0.1 5.0.0

Open the chart page →

57,669

shinobik8s-home-lab-repo

1 of 1 See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
shinobisystems/shinobi :latest	c2f5ce2e1067	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0

Open the chart page →

4,667

ohmyformkrzwiatrzyk

1 of 1 See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
ohmyform/ohmyform :1.0.3	afe53f4acdb1	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0

Open the chart page →

4,230

sentence-collectormozilla

1 of 2 See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
mozilla/sentencecollector :2.0.9	1da6ff5c4895	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

6,684

1 of 23 See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
socialmediamacroscope/smile_server :0.3.3	1a528c794270	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0

Open the chart page →

109,294

trudesktechpreta

1 of 3 See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
polonel/trudesk :1.2.6	0cf6513f6fe3	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0

Open the chart page →

4,017

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2021-23406.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	degenerator@2.2.0 pac-resolver@4.1.0	3.0.1 5.0.0

Open the chart page →

2,838

Container images carrying it

14 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
pantsel/konga :latest	c8172b75607d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	3
governify/registry :v3.4.0	d3f37f4f8168	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	2
codercom/code-server :3.10.2	47605610ad8d	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0	1
fiware/iotagent-ul :1.14.0	fe11f55a926d	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	degenerator@1.0.4 pac-resolver@2.0.0	3.0.1 5.0.0	1
library/ghost :4.37.0	767230c0f263	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	1
mozilla/sentencecollector :2.0.9	1da6ff5c4895	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	1
ohmyform/ohmyform :1.0.3	afe53f4acdb1	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0	1
polonel/trudesk :1.2.6	0cf6513f6fe3	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0	1
shinobisystems/shinobi :dev	3ca746937856	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0	1
shinobisystems/shinobi :latest	c2f5ce2e1067	degenerator@2.2.0 pac-resolver@4.2.0	3.0.1 5.0.0	1
socialmediamacroscope/smile_server :0.3.3	1a528c794270	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	1
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	degenerator@2.2.0 pac-resolver@4.1.0	3.0.1 5.0.0	1
ghcr.io/linuxserver/raneto :version-0.16.6	ef768f3df5d0	degenerator@1.0.4 pac-resolver@3.0.0	3.0.1 5.0.0	1