StackRadar

CVE-2021-43138

High

Advisory

Published 7 Apr 2022In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
0.033
88th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
116
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
1 of 1
affected package

Prototype Pollution in async

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
asyncnpm2.0.1, 2.3.0, 2.4.0, 2.5.0+8 more2.6.4, 3.2.2106
OSV records
GHSA-fwr7-v2mv-hh25

Charts affected

116 by stars
ChartLatestAffected imagesRadar Score
rtorrent-floodgeek-cookbookVerified publisher9.4.21 of 1See more

rtorrent-flood geek-cookbook 9.4.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jesec/rtorrent-flood:latestf0c894ec459e
async@2.6.3
2.6.4

Open the chart page →

2,000
shinobigeek-cookbookVerified publisher1.2.21 of 1See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
shinobisystems/shinobi:dev3ca746937856
async@2.6.3
2.6.4

Open the chart page →

4,591
Governify-Bluejaygovernify0.1.04 of 12See more

Governify-Bluejay governify 0.1.0

4 of the 12 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
governify/director:v1.4.0608c6940bb98
async@2.6.3
2.6.4
governify/registry:v3.4.0d3f37f4f8168
async@2.6.3
2.6.4
governify/render:v2.2.0daeca1ce28e6
async@3.2.1
3.2.2
governify/reporter:v2.2.038595913458f
async@3.2.1
3.2.2

Open the chart page →

22,512
Governify-Falcongovernify0.1.05 of 10See more

Governify-Falcon governify 0.1.0

5 of the 10 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
governify/collector-dynamic:v1.3.06d3d1a5b46a9
async@2.6.3
2.6.4
governify/director:v1.4.0608c6940bb98
async@2.6.3
2.6.4
governify/registry:v3.4.0d3f37f4f8168
async@2.6.3
2.6.4
governify/render:v2.2.0daeca1ce28e6
async@3.2.1
3.2.2
governify/reporter:v2.2.038595913458f
async@3.2.1
3.2.2

Open the chart page →

24,319
hubothalkeye0.0.11 of 1See more

hubot halkeye 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
halkeye/hubot:latest9764d2202130
async@2.6.3
2.6.4

Open the chart page →

2,116
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
async@2.6.3
2.6.4

Open the chart page →

3,003
zigbee2mqtthelm-chart-roeiVerified publisher1.19.01 of 1See more

zigbee2mqtt helm-chart-roei 1.19.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
async@3.2.0
3.2.2

Open the chart page →

2,173
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
async@2.6.3
2.6.4

Open the chart page →

24,161
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
async@3.2.0
3.2.2
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
async@2.6.3
2.6.4
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
async@2.6.3
2.6.4
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
async@3.2.0
3.2.2

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
async@2.6.3
2.6.4

Open the chart page →

8,213
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
async@2.6.3
2.6.4

Open the chart page →

4,253
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ibmcom/app-nav-ui:1.0.1e2a86997b36b
async@2.6.3
2.6.4

Open the chart page →

32,915
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
async@2.6.1
2.6.4

Open the chart page →

39,349
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
async@2.6.0
2.6.4

Open the chart page →

57,669
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jupyterhub/configurable-http-proxy:4.5.08ced0a2f8073
async@3.2.0
3.2.2

Open the chart page →

37,671
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
async@2.6.2
2.6.4

Open the chart page →

4,944
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
async@2.6.3
2.6.4

Open the chart page →

7,232
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
async@2.6.3
2.6.4

Open the chart page →

6,454
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
async@3.2.0
3.2.2

Open the chart page →

4,667
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
async@3.2.0
3.2.2

Open the chart page →

3,397
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
async@2.6.3
2.6.4

Open the chart page →

5,410
online-boutiquekubesphere-testVerified publisher0.1.01 of 11See more

online-boutique kubesphere-test 0.1.0

1 of the 11 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
async@3.2.0
3.2.2

Open the chart page →

26,018
multitenantkvalitetsitVerified publisher2.2.181 of 1See more

multitenant kvalitetsit 2.2.18

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
kvalitetsit/kithosting-networkpolicytests:0.0.12b99cfa3c5df
async@3.2.0
3.2.2

Open the chart page →

1,614
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
async@2.4.0
2.6.4

Open the chart page →

7,929
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
async@2.6.3
2.6.4

Open the chart page →

3,651
kubevismario-fVerified publisher2.0.11 of 1See more

kubevis mario-f 2.0.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
async@2.6.3
2.6.4

Open the chart page →

5,287
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
async@2.6.3
2.6.4

Open the chart page →

5,940
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
async@3.2.0
3.2.2

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
async@3.2.0
3.2.2

Open the chart page →

7,027
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
async@3.2.0
3.2.2

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
async@3.2.0
3.2.2

Open the chart page →

10,603
account-lookup-servicemojaloop13.0.02 of 4See more

account-lookup-service mojaloop 13.0.0

2 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
async@3.2.0
3.2.2
mojaloop/event-sidecar:v11.0.189b8ab71b74b
async@3.2.0
3.2.2

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.02 of 4See more

account-lookup-service-admin mojaloop 13.0.0

2 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
async@3.2.0
3.2.2
mojaloop/event-sidecar:v11.0.189b8ab71b74b
async@3.2.0
3.2.2

Open the chart page →

11,695
admin-api-svcmojaloop12.0.02 of 4See more

admin-api-svc mojaloop 12.0.0

2 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
async@3.2.0
3.2.2
mojaloop/event-sidecar:v11.0.189b8ab71b74b
async@3.2.0
3.2.2

Open the chart page →

12,108
fspiop-transfer-api-svcmojaloop12.0.12 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

2 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mojaloop/event-sidecar:v11.0.189b8ab71b74b
async@3.2.0
3.2.2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
async@2.6.3
2.6.4

Open the chart page →

11,479
mojaloopmojaloop14.0.04 of 6See more

mojaloop mojaloop 14.0.0

4 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
async@3.2.0
3.2.2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
async@3.2.0
3.2.2
mojaloop/event-sidecar:v11.0.189b8ab71b74b
async@3.2.0
3.2.2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
async@2.6.3
2.6.4

Open the chart page →

19,226
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
async@2.6.3
2.6.4

Open the chart page →

6,438
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
async@3.2.0
3.2.2

Open the chart page →

6,684
dashynas-helm-chartsVerified publisher1.0.41 of 1See more

dashy nas-helm-charts 1.0.4

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
lissy93/dashy:2.0.51991f7be5ed0
async@2.6.3
2.6.4

Open the chart page →

3,269
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_server:0.3.31a528c794270
async@2.3.0
2.6.4

Open the chart page →

109,294
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
async@3.2.0
3.2.2

Open the chart page →

27,465
ferdi-serverobeoneVerified publisher1.0.31 of 2See more

ferdi-server obeone 1.0.3

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
getferdi/ferdi-server:1.3.26e620b85afaa
async@2.6.3
2.6.4

Open the chart page →

1,866
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
async@2.6.3
2.6.4

Open the chart page →

9,968
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
async@2.6.3
2.6.4

Open the chart page →

6,524
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
async@2.6.3
2.6.4

Open the chart page →

5,215
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
async@3.2.1
3.2.2

Open the chart page →

3,638
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
async@2.6.3
2.6.4

Open the chart page →

29,220
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
async@2.6.3
2.6.4

Open the chart page →

29,220
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
async@2.6.3
2.6.4

Open the chart page →

2,460
sorry-cypresssoftonic1.20.01 of 4See more

sorry-cypress softonic 1.20.0

1 of the 4 container images this version deploys carry CVE-2021-43138.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
async@3.2.1
3.2.2

Open the chart page →

4,285

Container images carrying it

106 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
async@2.6.3
2.6.4
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
async@2.6.3
2.6.4
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
async@3.2.1
3.2.2
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
async@3.1.1
3.2.2
1
quay.io/wekan/wekan:v5.65cb17600883a3
async@3.2.1
3.2.2
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
async@2.6.0
2.6.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.