StackRadar

CVE-2022-23539

High

Advisory

Published 22 Dec 2022In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
84
of 17,781 indexed, latest versions
Container images
81
deployed by those charts
Fix available
1 of 1
affected package

jsonwebtoken unrestricted key type could lead to legacy keys usage

Carried by container images the latest versions of 84 of 17,781 indexed charts deploy, on 81 images.

Affected packageAffected versionsFixed inImages
jsonwebtokennpm7.4.1, 7.4.3, 8.4.0, 8.5.19.0.081
OSV records
GHSA-8cf7-32gw-wr33

Charts affected

84 by stars
ChartLatestAffected imagesRadar Score
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,285
uptime-kumaduyet0.1.71 of 1See more

uptime-kuma duyet 0.1.7

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.18.5a84767d7934f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,515
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

5,946
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
taigaio/taiga-events:6.4.00bf2d24a57d9
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

7,255
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

7,146
nightscoutgabe565Verified publisher0.13.01 of 2See more

nightscout gabe565 0.13.0

1 of the 2 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:15.0.2ad29ca7a4de6
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,521
audiobookshelfgeek-cookbookVerified publisher1.2.21 of 1See more

audiobookshelf geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

1,959
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

3,476
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

1,447
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

10,311
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

5,209
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
kubevious/parser:1.2.299ae7a5168c2
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

14,204
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

7,776
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

17,896
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/data-fair/simple-directory:438a4f32fad82
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

38,346
taigafermosit0.0.111 of 7See more

taiga fermosit 0.0.11

1 of the 7 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

8,496
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,260
homebridgegeek-cookbookVerified publisher5.3.21 of 1See more

homebridge geek-cookbook 5.3.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

15,653
uptime-kumageek-cookbookVerified publisher1.4.21 of 1See more

uptime-kuma geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.17.1a4eab252e5a2
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

5,079
youtubedl-materialgeek-cookbookVerified publisher4.4.21 of 1See more

youtubedl-material geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.23720b856bd2f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,410
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,000
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,723
flamerlex0.3.01 of 1See more

flame rlex 0.3.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
pawelmalak/flame:2.1.193e7b0abb603
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,449
taigaunxwaresVerified publisher2026.3.81 of 6See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
taigaio/taiga-events:latest92fc0822564f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

9,148
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

25,443
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

3,437
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

18,277
http-debugbicarus-labs0.1.01 of 1See more

http-debug bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
bicarus/http-https-echo:2785dd6a7e805e
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

867
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,455
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,083
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

5,209
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

3,769
mergeabledoubanVerified publisher0.2.21 of 1See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/leoquote/mergeable:latest451706815103
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,223
findery-marketfindery-market0.1.01 of 7See more

findery-market findery-market 0.1.0

1 of the 7 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
chandanteekinavar/findery-market-user-service:1.049e164a9a439
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

7,691
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

64,489
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

3,159
flamegabe565Verified publisher0.6.01 of 1See more

flame gabe565 0.6.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
pawelmalak/flame:multiarch2.3.19f88b17692a0
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,172
rtlgaloymoney0.4.31 of 2See more

rtl galoymoney 0.4.3

1 of the 2 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,090
rtlgaloymoney20.4.31 of 2See more

rtl galoymoney2 0.4.3

1 of the 2 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
shahanafarooqui/rtl:0.13.3e2195188a451
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,090
double-takegeek-cookbookVerified publisher2.3.21 of 1See more

double-take geek-cookbook 2.3.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
jakowenko/double-take:1.6.0b858bac9e32a
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

12,222
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,043
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

9,019
Governify-Bluejaygovernify0.1.02 of 12See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
governify/director:v1.4.0608c6940bb98
jsonwebtoken@8.5.1
9.0.0
governify/registry:v3.4.0d3f37f4f8168
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

22,512
Governify-Falcongovernify0.1.03 of 10See more

Governify-Falcon governify 0.1.0

3 of the 10 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
governify/collector-dynamic:v1.3.06d3d1a5b46a9
jsonwebtoken@8.5.1
9.0.0
governify/director:v1.4.0608c6940bb98
jsonwebtoken@8.5.1
9.0.0
governify/registry:v3.4.0d3f37f4f8168
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

24,319
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,682
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
jsonwebtoken@7.4.1
9.0.0
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
jsonwebtoken@7.4.3
9.0.0
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
jsonwebtoken@7.4.3
9.0.0
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
jsonwebtoken@7.4.3
9.0.0

Open the chart page →

89,959
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

2,463
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

4,253
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2022-23539.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
jsonwebtoken@8.5.1
9.0.0

Open the chart page →

7,232

Container images carrying it

81 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
requarks/wiki:canary-2.5.2438b5865a7386c
jsonwebtoken@8.5.1
9.0.0
1
roadiehq/community-backstage-image:latestef355bf5b639
jsonwebtoken@8.5.1
9.0.0
1
samajh/alprbackend:latestea742b4372ad
jsonwebtoken@8.5.1
9.0.0
1
shahanafarooqui/rtl:0.11.0d0cd3d868aca
jsonwebtoken@8.5.1
9.0.0
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
jsonwebtoken@8.5.1
9.0.0
1
socialmediamacroscope/smile_server:0.3.31a528c794270
jsonwebtoken@8.5.1
9.0.0
1
sqlpad/sqlpad:6.7d3d2f430dffd
jsonwebtoken@8.5.1
9.0.0
1
stanfordoval/almond-server:latest1a63cdccedaf
jsonwebtoken@8.5.1
9.0.0
1
taigaio/taiga-events:6.4.00bf2d24a57d9
jsonwebtoken@8.5.1
9.0.0
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
jsonwebtoken@8.5.1
9.0.0
1
tzahi12345/youtubedl-material:4.23720b856bd2f
jsonwebtoken@8.5.1
9.0.0
1
ubercadence/web:v3.29.58564a5b44a6d
jsonwebtoken@8.5.1
9.0.0
1
youssef11gaber10/deployment-ui-react:latestba6853e35c60
jsonwebtoken@8.5.1
9.0.0
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
jsonwebtoken@7.4.1
9.0.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
jsonwebtoken@7.4.3
9.0.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
jsonwebtoken@7.4.3
9.0.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
jsonwebtoken@7.4.3
9.0.0
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/k10app/basicuserservice:latest2ee057ad3bef
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/k10app/catalog:latest639c980be0f1
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/k10app/order:lateste1017d0dbd78
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/leoquote/mergeable:latest451706815103
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
jsonwebtoken@8.5.1
9.0.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
jsonwebtoken@8.5.1
9.0.0
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
jsonwebtoken@8.5.1
9.0.0
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
jsonwebtoken@8.5.1
9.0.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.