StackRadar

CVE-2021-3805

High

Advisory

Published 20 Sept 2021In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.021
81st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
11
of 17,781 indexed, latest versions
Container images
12
deployed by those charts
Fix available
1 of 1
affected package

Prototype Pollution in object-path

Carried by container images the latest versions of 11 of 17,781 indexed charts deploy, on 12 images.

Affected packageAffected versionsFixed inImages
object-pathnpm0.9.2, 0.11.4, 0.11.50.11.812
OSV records
GHSA-8v63-cqqc-6r2c

Charts affected

11 by stars
ChartLatestAffected imagesRadar Score
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
object-path@0.11.4
0.11.8

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
object-path@0.11.5
0.11.8

Open the chart page →

5,946
graphql-gatewaygraphql-gatewayVerified publisher0.1.51 of 1See more

graphql-gateway graphql-gateway 0.1.5

1 of the 1 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
hansehe/graphql-gateway:1.0.458e09540afbc
object-path@0.11.4
0.11.8

Open the chart page →

1,660
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
object-path@0.11.4
0.11.8

Open the chart page →

25,456
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
object-path@0.11.4
0.11.8
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
object-path@0.11.4
0.11.8
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
object-path@0.11.4
0.11.8
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
object-path@0.11.4
0.11.8

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
object-path@0.11.4
0.11.8

Open the chart page →

8,213
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
object-path@0.9.2
0.11.8

Open the chart page →

57,669
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
object-path@0.11.5
0.11.8

Open the chart page →

7,232
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
object-path@0.11.5
0.11.8

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
object-path@0.11.5
0.11.8

Open the chart page →

7,027
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-3805.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
object-path@0.11.4
0.11.8

Open the chart page →

3,696

Container images carrying it

12 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
object-path@0.11.4
0.11.8
2
mesosphere/kommander:6.100.13917e82333a9
object-path@0.11.5
0.11.8
2
hansehe/graphql-gateway:1.0.458e09540afbc
object-path@0.11.4
0.11.8
1
ibmcom/microclimate-portal:latested5505e5c7ec
object-path@0.9.2
0.11.8
1
ondrejsika/parking:latestb1fd497416c8
object-path@0.11.4
0.11.8
1
roadiehq/community-backstage-image:latestef355bf5b639
object-path@0.11.5
0.11.8
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
object-path@0.11.4
0.11.8
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
object-path@0.11.4
0.11.8
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
object-path@0.11.4
0.11.8
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
object-path@0.11.4
0.11.8
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
object-path@0.11.5
0.11.8
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
object-path@0.11.4
0.11.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.