StackRadarChart IndexLive demo

CVE-2021-26540

Medium

Advisory

Published 6 May 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.018; 77th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 15; of 17,781 indexed, latest versions
Container images: 11; deployed by those charts
Fix available: 1 of 1; affected package

Improper Input Validation in sanitize-html

Carried by container images the latest versions of 15 of 17,781 indexed charts deploy, on 11 images.

Affected package	Affected versions	Fixed in	Images
sanitize-htmlnpm	1.14.1, 1.18.5, 1.19.1, 1.27.5	2.3.2	11

OSV records: GHSA-mjxr-4v3x-q3m4

Charts affected

15 by stars

Chart

Latest

Affected images

Radar Score

microcksmicrocks

0.8.0-helm-3.kube-1.17

1 of 5 See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
microcks/microcks-postman-runtime :latest	cb72e46a1b3c	sanitize-html@1.14.1	2.3.2

Open the chart page →

10,732

data-fairdata354-helm

1 of 12 See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
ghcr.io/data-fair/portals :1	8b621866ceb2	sanitize-html@1.27.5	2.3.2

Open the chart page →

38,346

daskcloudnativeapp

1 of 2 See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
daskdev/dask-notebook :1.1.0	052630f5ca04	sanitize-html@1.18.5	2.3.2

Open the chart page →

29,901

1 of 7 See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
amundsendev/amundsen-frontend :2.1.1	69e7915e61c1	sanitize-html@1.19.1	2.3.2

Open the chart page →

11,174

Governify-Bluejaygovernify

1 of 12 See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
governify/assets-manager :v1.4.1	2987672448c7	sanitize-html@1.27.5	2.3.2

Open the chart page →

22,512

Governify-Falcongovernify

1 of 10 See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
governify/assets-manager :v1.4.1	2987672448c7	sanitize-html@1.27.5	2.3.2

Open the chart page →

24,319

account-lookup-servicemojaloop

1 of 4 See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	sanitize-html@1.27.5	2.3.2

Open the chart page →

11,695

account-lookup-service-adminmojaloop

1 of 4 See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	sanitize-html@1.27.5	2.3.2

Open the chart page →

11,695

admin-api-svcmojaloop

1 of 4 See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	sanitize-html@1.27.5	2.3.2

Open the chart page →

12,108

finance-portalmojaloop

3 of 11 See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	sanitize-html@1.27.5	2.3.2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	sanitize-html@1.27.5	2.3.2
mojaloop/role-assignment-service :v2.1.0	def4bf273721	sanitize-html@1.27.5	2.3.2

Open the chart page →

14,809

fspiop-transfer-api-svcmojaloop

1 of 3 See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	sanitize-html@1.27.5	2.3.2

Open the chart page →

11,479

mojaloopmojaloop

3 of 6 See more

mojaloop mojaloop 14.0.0

3 of the 6 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	sanitize-html@1.27.5	2.3.2
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	sanitize-html@1.27.5	2.3.2
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	sanitize-html@1.27.5	2.3.2

Open the chart page →

19,226

reporting-events-processor-svcmojaloop

1 of 1 See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	sanitize-html@1.27.5	2.3.2

Open the chart page →

2,631

reporting-hub-bop-experience-api-svcmojaloop

1 of 1 See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	sanitize-html@1.27.5	2.3.2

Open the chart page →

2,318

role-assignment-servicemojaloop

1 of 1 See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2021-26540.

Container image	Digest	Package	Fixed in
mojaloop/role-assignment-service :v2.1.0	def4bf273721	sanitize-html@1.27.5	2.3.2

Open the chart page →

2,316

Container images carrying it

11 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	sanitize-html@1.27.5	2.3.2	3
governify/assets-manager :v1.4.1	2987672448c7	sanitize-html@1.27.5	2.3.2	2
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	sanitize-html@1.27.5	2.3.2	2
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	sanitize-html@1.27.5	2.3.2	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	sanitize-html@1.27.5	2.3.2	2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	sanitize-html@1.27.5	2.3.2	2
mojaloop/role-assignment-service :v2.1.0	def4bf273721	sanitize-html@1.27.5	2.3.2	2
amundsendev/amundsen-frontend :2.1.1	69e7915e61c1	sanitize-html@1.19.1	2.3.2	1
daskdev/dask-notebook :1.1.0	052630f5ca04	sanitize-html@1.18.5	2.3.2	1
microcks/microcks-postman-runtime :latest	cb72e46a1b3c	sanitize-html@1.14.1	2.3.2	1
ghcr.io/data-fair/portals :1	8b621866ceb2	sanitize-html@1.27.5	2.3.2	1