CVE-2021-37713

High

Advisory

Published 31 Aug 2021In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.6; base score, highest
EPSS: 0.013; 68th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 201; of 17,781 indexed, latest versions
Container images: 203; deployed by those charts
Fix available: 2 of 2; affected packages

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

Carried by container images the latest versions of 201 of 17,781 indexed charts deploy, on 203 images.

Affected package	Affected versions	Fixed in	Images
nodejsapk	12.17.0-r0, 12.18.4-r0, 12.20.1-r0, 12.22.4-r0+1 more	12.22.6-r0, 14.17.6-r0	7
tarnpm	1.0.3, 2.2.1, 2.2.2, 4.0.2+11 more	4.4.18, 6.1.9	202

OSV records: ALPINE-CVE-2021-37713 GHSA-5955-9wpr-37jh

Charts affected

201 by stars

Chart

Latest

Affected images

Radar Score

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-37713.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	tar@4.4.8	4.4.18

Open the chart page →

1,309

Container images carrying it

203 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	tar@4.4.2	4.4.18	1
socialmediamacroscope/smile_server :0.3.3	1a528c794270	tar@6.1.0	6.1.9	1
sqlpad/sqlpad :6.7	d3d2f430dffd	tar@2.2.2	4.4.18	1
stanfordoval/almond-server :latest	1a63cdccedaf	tar@2.2.2	4.4.18	1
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	tar@4.4.10	4.4.18	1
taigaio/taiga-events :6.4.0	0bf2d24a57d9	tar@4.4.13	4.4.18	1
temporalio/web :1.14.0	33cfa863d8ce	tar@4.4.13	4.4.18	1
testhubio/testhub-frontend :on-prem	e86c2db53be8	nodejs@12.20.1-r0 tar@4.4.13	12.22.6-r0 4.4.18	1
thelounge/thelounge :4.3.0-alpine	0037aa258261	tar@2.2.2	4.4.18	1
thelounge/thelounge :4.2.0-alpine	639978459c3a	tar@4.4.13	4.4.18	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	tar@2.2.1	4.4.18	1
tooljet/tooljet-ce :v1.18.0	c85a4720e42e	tar@4.4.13	4.4.18	1
trufflesuite/ganache-cli :v6.12.2	c062707f17f3	tar@4.4.13	4.4.18	1
tzahi12345/youtubedl-material :4.2	3720b856bd2f	nodejs@12.20.1-r0 tar@4.4.13	12.22.6-r0 4.4.18	1
ubercadence/web :v3.29.5	8564a5b44a6d	tar@2.2.2	4.4.18	1
wekanteam/wekan :v4.22	68a51f0327df	tar@4.4.13	4.4.18	1
willwill/kube-slack :v4.1.1	d443017aae98	tar@2.2.1	4.4.18	1
wiremind/scrapoxy :latest	e7048929a676	tar@4.4.13	4.4.18	1
zazuko/trifid :2.3.7	054be137de70	tar@4.4.13	4.4.18	1
zooz/predator :1.6	f491d1f7a865	tar@2.2.2	4.4.18	1
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	tar@6.1.0	6.1.9	1
gcr.io/google-samples/microservices-demo/currencyservice :v0.2.3	49d458a3650f	tar@4.4.13	4.4.18	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	tar@6.1.0	6.1.9	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	tar@4.4.13	4.4.18	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	tar@4.4.13	4.4.18	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	tar@4.4.13	4.4.18	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	tar@4.4.13	4.4.18	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	tar@4.4.13	4.4.18	1
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	tar@4.4.13	4.4.18	1
ghcr.io/flaresolverr/flaresolverr :v1.2.8	96f8c08c0c1b	tar@6.0.5	6.1.9	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	tar@4.4.13	4.4.18	1
ghcr.io/leoquote/mergeable :latest	451706815103	tar@4.4.13	4.4.18	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	tar@2.2.2	4.4.18	1
ghcr.io/mario-f/kubevis :v1.4.0	763daf9caf8e	tar@2.2.2	4.4.18	1
ghcr.io/mmontes11/iot-back :v3.11.0	96683c54ae65	tar@4.4.13	4.4.18	1
ghcr.io/mmontes11/iot-biot :v3.11.0	33f7976b26a8	tar@4.4.13	4.4.18	1
ghcr.io/mmontes11/iot-thing :v3.11.0	542e91e8499c	tar@4.4.13	4.4.18	1
ghcr.io/mmontes11/iot-worker :v3.11.0	491bb243f555	tar@4.4.13	4.4.18	1
ghcr.io/sct/overseerr :1.26.1	254d16af8f71	tar@6.1.0	6.1.9	1
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	tar@6.1.0	6.1.9	1
quay.io/ctrontesting/iofog-controller :latest	10df27bc5560	tar@2.2.2	4.4.18	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	tar@2.2.2	4.4.18	1
quay.io/hewlettpackardenterprise/squest :2.8.4	65694109877e	tar@6.0.5	6.1.9	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	tar@2.2.2	4.4.18	1
quay.io/ibmgaragecloud/nodejs :latest	01c3b7acb301	tar@4.4.13	4.4.18	1
quay.io/ibmgaragecloud/slack-notifications :latest	041df93e2bac	tar@4.4.13	4.4.18	1
quay.io/mongodb/farm-intro-frontend :0.1	99ccdfd543e1	tar@6.0.5	6.1.9	1
quay.io/renokico/laravel-helm-demo :0.6.0	3207f957e80c	nodejs@14.17.4-r0 tar@6.1.0	14.17.6-r0 6.1.9	1
quay.io/renokico/laravel-helm-demo :worker-0.6.0	4b188259267e	nodejs@14.17.4-r0 tar@6.1.0	14.17.6-r0 6.1.9	1
quay.io/renokico/laravel-helm-demo :octane-0.6.0	cad83090c58f	nodejs@12.22.4-r0 tar@4.4.15	12.22.6-r0 4.4.18	1