StackRadar

CVE-2021-29060

Medium

Advisory

Published 22 Jun 2021In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.031
87th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
39
of 17,781 indexed, latest versions
Container images
33
deployed by those charts
Fix available
1 of 1
affected package

Regular Expression Denial of Service (ReDOS)

Carried by container images the latest versions of 39 of 17,781 indexed charts deploy, on 33 images.

Affected packageAffected versionsFixed inImages
color-stringnpm0.3.0, 1.5.2, 1.5.3, 1.5.41.5.533
OSV records
GHSA-257v-vj4p-3w2h

Charts affected

39 by stars
ChartLatestAffected imagesRadar Score
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
color-string@0.3.0
1.5.5

Open the chart page →

5,251
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:4.2.281bd96729c14
color-string@1.5.3
1.5.5

Open the chart page →

52,919
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
color-string@1.5.3
1.5.5

Open the chart page →

8,213
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
color-string@0.3.0
1.5.5

Open the chart page →

5,209
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
color-string@1.5.3
1.5.5

Open the chart page →

6,868
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
color-string@1.5.3
1.5.5

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
color-string@1.5.3
1.5.5

Open the chart page →

10,730
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
color-string@1.5.3
1.5.5

Open the chart page →

3,444
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
color-string@1.5.3
1.5.5

Open the chart page →

4,410
testhubteshubVerified publisher0.1.41 of 3See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
testhubio/testhub-frontend:on-preme86c2db53be8
color-string@1.5.3
1.5.5

Open the chart page →

7,517
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
color-string@0.3.0
1.5.5

Open the chart page →

18,277
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
color-string@1.5.3
1.5.5

Open the chart page →

5,806
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
color-string@0.3.0
1.5.5

Open the chart page →

29,901
ethereumcloudnativeapp1.0.01 of 3See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
color-string@0.3.0
1.5.5

Open the chart page →

27,417
kube-slackcloudnativeapp1.0.01 of 1See more

kube-slack cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
willwill/kube-slack:v4.1.1d443017aae98
color-string@1.5.3
1.5.5

Open the chart page →

1,937
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
color-string@1.5.3
1.5.5

Open the chart page →

25,456
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
color-string@1.5.4
1.5.5

Open the chart page →

12,907
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
color-string@0.3.0
1.5.5

Open the chart page →

5,209
Governify-Bluejaygovernify0.1.02 of 12See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
color-string@1.5.3
1.5.5
governify/registry:v3.4.0d3f37f4f8168
color-string@1.5.4
1.5.5

Open the chart page →

22,512
Governify-Falcongovernify0.1.02 of 10See more

Governify-Falcon governify 0.1.0

2 of the 10 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
color-string@1.5.3
1.5.5
governify/registry:v3.4.0d3f37f4f8168
color-string@1.5.4
1.5.5

Open the chart page →

24,319
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
color-string@1.5.3
1.5.5

Open the chart page →

3,003
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
color-string@1.5.3
1.5.5

Open the chart page →

8,213
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
color-string@1.5.4
1.5.5

Open the chart page →

7,232
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
color-string@0.3.0
1.5.5

Open the chart page →

6,454
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
color-string@1.5.2
1.5.5

Open the chart page →

7,929
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
color-string@1.5.3
1.5.5

Open the chart page →

3,651
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
color-string@1.5.3
1.5.5

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
color-string@1.5.3
1.5.5

Open the chart page →

7,027
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
color-string@1.5.3
1.5.5

Open the chart page →

11,479
mojaloopmojaloop14.0.01 of 6See more

mojaloop mojaloop 14.0.0

1 of the 6 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
color-string@1.5.3
1.5.5

Open the chart page →

19,226
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
color-string@1.5.4
1.5.5

Open the chart page →

6,438
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
color-string@1.5.3
1.5.5

Open the chart page →

6,684
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
color-string@0.3.0
1.5.5

Open the chart page →

109,294
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
color-string@1.5.4
1.5.5

Open the chart page →

27,465
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
color-string@1.5.4
1.5.5

Open the chart page →

2,460
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
color-string@1.5.3
1.5.5

Open the chart page →

3,827
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
color-string@0.3.0
1.5.5

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
color-string@0.3.0
1.5.5

Open the chart page →

22,665
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-29060.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
color-string@1.5.3
1.5.5

Open the chart page →

5,806

Container images carrying it

33 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
pantsel/konga:latestc8172b75607d
color-string@0.3.0
1.5.5
3
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
color-string@1.5.3
1.5.5
2
governify/assets-manager:v1.4.12987672448c7
color-string@1.5.3
1.5.5
2
governify/registry:v3.4.0d3f37f4f8168
color-string@1.5.4
1.5.5
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
color-string@1.5.3
1.5.5
2
mesosphere/kommander:6.100.13917e82333a9
color-string@1.5.3
1.5.5
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
color-string@1.5.3
1.5.5
2
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
color-string@1.5.2
1.5.5
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
color-string@1.5.3
1.5.5
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
color-string@1.5.3
1.5.5
1
conduction/conduction-ui-app:devd591f5e6f2a9
color-string@1.5.4
1.5.5
1
daskdev/dask-notebook:1.1.0052630f5ca04
color-string@0.3.0
1.5.5
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
color-string@0.3.0
1.5.5
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
color-string@1.5.3
1.5.5
1
henrywhitaker3/speedtest-tracker:latest47159a940229
color-string@1.5.4
1.5.5
1
jayfong/yapi:1.10.2163e5d621910
color-string@0.3.0
1.5.5
1
jupyterhub/configurable-http-proxy:4.2.281bd96729c14
color-string@1.5.3
1.5.5
1
lavandadelpatio/frontend:latest501c3f31e0bc
color-string@1.5.3
1.5.5
1
linuxserver/codimd:latestb801bbcf6386
color-string@1.5.4
1.5.5
1
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
color-string@1.5.3
1.5.5
1
misskey/misskey:12.110.1e08b7c478093
color-string@0.3.0
1.5.5
1
mozilla/sentencecollector:2.0.91da6ff5c4895
color-string@1.5.3
1.5.5
1
roadiehq/community-backstage-image:latestef355bf5b639
color-string@1.5.4
1.5.5
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
color-string@0.3.0
1.5.5
1
temporalio/web:1.14.033cfa863d8ce
color-string@0.3.0
1.5.5
1
testhubio/testhub-frontend:on-preme86c2db53be8
color-string@1.5.3
1.5.5
1
tzahi12345/youtubedl-material:4.23720b856bd2f
color-string@1.5.3
1.5.5
1
ubercadence/web:v3.29.58564a5b44a6d
color-string@0.3.0
1.5.5
1
willwill/kube-slack:v4.1.1d443017aae98
color-string@1.5.3
1.5.5
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
color-string@1.5.3
1.5.5
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
color-string@1.5.3
1.5.5
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
color-string@1.5.4
1.5.5
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
color-string@1.5.3
1.5.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.