StackRadar

CVE-2022-23515

Medium

Advisory

Published 13 Dec 2022In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
12
of 17,781 indexed, latest versions
Container images
13
deployed by those charts
Fix available
1 of 1
affected package

Improper neutralization of data URIs may allow XSS in Loofah

Carried by container images the latest versions of 12 of 17,781 indexed charts deploy, on 13 images.

Affected packageAffected versionsFixed inImages
loofahgem2.5.0, 2.7.0, 2.8.0, 2.9.1+3 more2.19.113
OSV records
GHSA-228g-948r-83gx

Charts affected

12 by stars
ChartLatestAffected imagesRadar Score
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
loofah@2.15.0
2.19.1

Open the chart page →

19,337
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
loofah@2.5.0
2.19.1

Open the chart page →

18,137
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
loofah@2.9.1
2.19.1

Open the chart page →

6,110
gollumgeek-cookbookVerified publisher3.4.21 of 3See more

gollum geek-cookbook 3.4.2

1 of the 3 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
gollumorg/gollum:latest7cd5305a3cf7
loofah@2.8.0
2.19.1

Open the chart page →

4,629
docker-registry-browsergmelilloVerified publisher0.1.21 of 1See more

docker-registry-browser gmelillo 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.3.5430a440d95af
loofah@2.7.0
2.19.1

Open the chart page →

4,108
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
loofah@2.12.0
2.19.1

Open the chart page →

6,810
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
loofah@2.12.0
2.19.1

Open the chart page →

3,564
gitlabkubesphereVerified publisher4.2.34 of 17See more

gitlab kubesphere 4.2.3

4 of the 17 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
loofah@2.5.0
2.19.1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
loofah@2.5.0
2.19.1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
loofah@2.5.0
2.19.1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
loofah@2.5.0
2.19.1

Open the chart page →

38,133
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
loofah@2.18.0
2.19.1

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
loofah@2.18.0
2.19.1

Open the chart page →

12,791
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
loofah@2.12.0
2.19.1

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2022-23515.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
loofah@2.12.0
2.19.1

Open the chart page →

14,154

Container images carrying it

13 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
pecan/bety:5.4.1f825d480cd62
loofah@2.12.0
2.19.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
loofah@2.18.0
2.19.1
2
gollumorg/gollum:latest7cd5305a3cf7
loofah@2.8.0
2.19.1
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
loofah@2.5.0
2.19.1
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
loofah@2.7.0
2.19.1
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
loofah@2.12.0
2.19.1
1
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
loofah@2.5.0
2.19.1
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
loofah@2.5.0
2.19.1
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
loofah@2.5.0
2.19.1
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
loofah@2.5.0
2.19.1
1
openproject/community:12.0.2734743d11094
loofah@2.12.0
2.19.1
1
uffizzi/app:latest66e9e3937c60
loofah@2.15.0
2.19.1
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
loofah@2.9.1
2.19.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.