StackRadarChart IndexLive demo

CVE-2022-24999

High

Advisory

Published 26 Nov 2022In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.151; 97th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 289; of 17,781 indexed, latest versions
Container images: 283; deployed by those charts
Fix available: 2 of 2; affected packages

qs vulnerable to Prototype Pollution

Carried by container images the latest versions of 289 of 17,781 indexed charts deploy, on 283 images.

Affected package	Affected versions	Fixed in	Images
qsnpm	0.5.6, 0.6.5, 1.2.2, 2.2.4+16 more	6.2.4, 6.3.3, 6.4.1, 6.5.3+4 more	283
node-qsdeb	6.9.1+ds-1	6.9.1+ds-1ubuntu0.1~esm1	2

OSV records: GHSA-hrpp-h998-j3pp UBUNTU-CVE-2022-24999
Also known as: USN-7693-1

Charts affected

289 by stars

Chart

Latest

Affected images

Radar Score

hedgedocschmitzis

1 of 1 See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	qs@6.9.3	6.9.7

Open the chart page →

3,118

wekanschmitzis

1 of 1 See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/wekan/wekan :v5.65	cb17600883a3	qs@6.4.0	6.4.1

Open the chart page →

3,638

hedgedocsi-gitops

1 of 2 See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.12.0	89bd85d7817f	qs@2.3.3	6.2.4

Open the chart page →

2,638

parkingsikalabs

1 of 1 See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
ondrejsika/parking :latest	b1fd497416c8	qs@6.5.2	6.5.3

Open the chart page →

3,696

simple-db-app-chartsimple-db-app

1 of 2 See more

simple-db-app-chart simple-db-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
htmlprogrammer2001/simple-db-app :1.0	a7e0a233a9bc	qs@6.9.6	6.9.7

Open the chart page →

1,925

simple-db-app-chart-with-dependencysimple-db-app

1 of 3 See more

simple-db-app-chart-with-dependency simple-db-app 0.1.0

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
htmlprogrammer2001/simple-db-app :1.0	a7e0a233a9bc	qs@6.9.6	6.9.7

Open the chart page →

1,925

first-appsimple-helm-chart

1 of 1 See more

first-app simple-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
leeyoongti/first-app :1.0.0	21d66cb76352	qs@6.7.0	6.7.3

Open the chart page →

2,154

logsmo-helm-chart

1 of 6 See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	qs@6.5.2	6.5.3

Open the chart page →

29,220

pombasmo-helm-chart

1 of 17 See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	qs@6.5.2	6.5.3

Open the chart page →

29,220

speedtest-trackersoblivionscall

1 of 1 See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
henrywhitaker3/speedtest-tracker :latest	47159a940229	qs@6.7.0	6.7.3

Open the chart page →

2,460

pwssoketi

1 of 1 See more

pws soketi 0.2.4

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	qs@6.7.0	6.7.3

Open the chart page →

3,228

alertmanager-to-alerta-botsomeblackmagic

1 of 1 See more

alertmanager-to-alerta-bot someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
someblackmagic/alertmanager-to-alerta-bot :latest	78bf43744ea5	qs@6.10.1	6.10.3

Open the chart page →

2,121

alert-mappersomeblackmagic

1 of 1 See more

alert-mapper someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
someblackmagic/alert-mapper :v0.1.0	88351d85c04c	qs@6.10.1	6.10.3

Open the chart page →

1,890

speckle-server-branch-testing6speckle

2.25.10-branch.testing6.645-b125c1e

1 of 4 See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	qs@6.7.0	6.7.3

Open the chart page →

11,100

nordmart-reviewstakater

1 of 3 See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review-ui :1.0.14	3f4926eedc74	qs@6.5.2	6.5.3

Open the chart page →

11,554

nordmart-review-instancestakater

1 of 3 See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
stakater/stakater-nordmart-review-ui :1.0.14	3f4926eedc74	qs@6.5.2	6.5.3

Open the chart page →

11,554

fdi-dotstatsuite-dlmstatcan

1 of 1 See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	qs@6.5.2	6.5.3

Open the chart page →

3,881

pachydermstatcan

1 of 4 See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	qs@6.5.2	6.5.3

Open the chart page →

4,967

kurento_webrtc_demostunner

1 of 2 See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	qs@5.2.1	6.2.4

Open the chart page →

12,460

stunner-kurento-one2one-callstunner

1 of 2 See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	qs@5.2.1	6.2.4

Open the chart page →

12,460

grafanasvtech-public-helm-charts

1 of 2 See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_grafana :v1.2.2	1d71314424aa	node-qs@6.9.1+ds-1 qs@6.9.1	6.9.1+ds-1ubuntu0.1~esm1 6.9.7

Open the chart page →

10,902

1 of 1 See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	qs@6.5.2	6.5.3

Open the chart page →

3,827

trudesktechpreta

1 of 3 See more

4,017

thanhvt27-lab-k8sthanh-vt

1 of 5 See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
pysga1996/python-redis-web :latest	fdeec30ad482	qs@6.7.0	6.7.3

Open the chart page →

4,661

csmmth-charts

1 of 3 See more

3,576

pock-helm-charttinote-chart

1 of 3 See more

pock-helm-chart tinote-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
denisshav/backend :latest	4cc8dc5a4499	qs@6.5.2	6.5.3

Open the chart page →

6,881

joplintobiassackmann

1 of 2 See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
joplin/server :latest	3f7b852959aa	qs@6.5.2	6.5.3

Open the chart page →

5,535

kubernetes-external-secretstrozz

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	qs@6.9.3	6.9.7

Open the chart page →

2,838

genievhdirk

1 of 1 See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
stanfordoval/almond-server :latest	1a63cdccedaf	qs@6.5.2	6.5.3

Open the chart page →

3,129

1 of 1 See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	qs@6.9.3	6.9.7

Open the chart page →

3,118

queryservice-gatewaywbstack

1 of 1 See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	qs@6.5.2	6.5.3

Open the chart page →

2,559

webhookiewebhookie

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	qs@6.10.1	6.10.3

Open the chart page →

14,364

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	qs@6.10.1	6.10.3

Open the chart page →

28,605

cadencewenerme

1 of 5 See more

10,127

temporalwenerme

1 of 13 See more

22,665

opendistro-eswitcom-gmbh

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	qs@6.5.2	6.5.3

Open the chart page →

5,806

1 of 1 See more

1,752

helloworldyotron-helm-charts

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	qs@6.5.2	6.5.3

Open the chart page →

1,309

alertmanager-matrix-forwarderzloi-space

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-24999.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	qs@6.5.2	6.5.3

Open the chart page →

3,118

Container images carrying it

283 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
assistiot/open_api_frontend :1.0.1	f11d82defc70	qs@6.5.2	6.5.3	1
aureliengasser/http-folder :1.1.1	11c4318c2571	qs@6.5.2	6.5.3	1
bastilimbach/docker-magicmirror :v2.15.0	41b0835ab31e	qs@6.5.2	6.5.3	1
bicarus/mx-api-service :1.0.2-hf1	dab88659ae3b	qs@6.9.3	6.9.7	1
billimek/node-influx-uptimerobot :latest	5814f0bcf5ba	qs@6.5.2	6.5.3	1
bluerange/bluerange-mosquitto :25	f1bfbba84832	qs@6.5.2	6.5.3	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	qs@6.5.2	6.5.3	1
carbonetes/carbonetes-analyzer :1.0.3	1b9b93c9a37f	qs@6.5.2	6.5.3	1
catalysm/csmm :latest	f003b35f54d9	qs@6.7.0	6.7.3	1
chatwoot/chatwoot :v4.15.1	67ebc751c171	qs@6.5.2	6.5.3	1
christianhuth/node-hostname :1.0.1	c07f414a3e4b	qs@6.5.2	6.5.3	1
cnieg/maildev :v1.1.9	98ee05668915	qs@6.7.0	6.7.3	1
coderaiser/cloudcmd :16.6.1	b34a9775c7ce	qs@6.5.2	6.5.3	1
codercom/code-server :4.11.0-debian	1e2cc688008e	qs@6.7.0	6.7.3	1
codercom/code-server :3.10.2	47605610ad8d	qs@6.7.0	6.7.3	1
conduction/conduction-ui-app :dev	d591f5e6f2a9	qs@6.7.0	6.7.3	1
cryptexlabs/authf :0.12.11	189c07411d7c	qs@6.7.0	6.7.3	1
daskdev/dask-notebook :1.1.0	052630f5ca04	qs@6.5.1	6.5.3	1
datarhei/restreamer :0.6.4	655e12f9eeed	qs@6.7.0	6.7.3	1
davidvmar/urjc-davidvmar-external-service :1.0.0	2a68e9ac7f09	qs@6.5.2	6.5.3	1
davidvmar/urjc-davidvmar-server :1.0.0	5663f5b24615	qs@6.7.0	6.7.3	1
decayofmind/hubot :3.3.2	1e18e92fe694	qs@6.5.2	6.5.3	1
denisshav/backend :latest	4cc8dc5a4499	qs@6.5.2	6.5.3	1
dessalines/lemmy-ui :0.19.20	ee4c620d8e93	qs@6.5.1	6.5.3	1
devkrishan001/backend :latest	f1c3acadeabe	qs@0.5.6	6.2.4	1
devspacecloud/ui :0.3.3	deef55ff29a7	qs@6.5.2	6.5.3	1
dipugodocker/pdf-editor :1.0-frontend	d431c37fe1cd	qs@6.9.3	6.9.7	1
eameti/node-app :latest	f36642affa86	qs@6.5.2	6.5.3	1
electerious/ackee :3.2.0	5e7173fa321c	qs@6.5.2	6.5.3	1
enketo/enketo-express :3.0.4	dcad9c2273f6	qs@6.5.2	6.5.3	1
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	qs@6.5.1	6.5.3	1
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	qs@6.5.2	6.5.3	1
ethersphere/bzz-token-service :latest	7624f11a72ad	qs@6.7.0	6.7.3	1
ethersphere/onboarding-faucet :0.3.0	513154aab230	qs@6.9.3	6.9.7	1
ethpandaops/blobscan-indexer :latest	c58eb9ffe446	qs@6.5.2	6.5.3	1
fanzynoodle/smeejas :0.0.1	5f9916c1a287	qs@6.5.2	6.5.3	1
felddy/foundryvtt :0.8.3	6c5d90b90349	qs@6.5.2	6.5.3	1
fiware/idm :8.3.3	a1b6ed4ae84f	qs@6.5.2	6.5.3	1
fiware/iotagent-ul :1.14.0	fe11f55a926d	qs@6.5.2	6.5.3	1
flagsmith/flagsmith-frontend :v2.6.0	df02a29e8b0c	qs@6.5.2	6.5.3	1
frappe/frappe-socketio :v13.4.1	2095767a9e82	qs@6.5.2	6.5.3	1
galaxy/galaxy-init :v18.01	0267bad550e6	qs@6.4.0	6.4.1	1
getferdi/ferdi-server :1.3.2	6e620b85afaa	qs@6.5.2	6.5.3	1
gethue/hue :4.11.0	11b649636e68	qs@6.5.2	6.5.3	1
gethue/hue :4.10.0	5702b2c37ff9	qs@6.5.2	6.5.3	1
governify/collector-dynamic :v1.3.0	6d3d1a5b46a9	qs@6.7.0	6.7.3	1
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	qs@6.5.2	6.5.3	1
gristlabs/grist :0.7.9	6e71b1914a7e	qs@6.5.2	6.5.3	1
halkeye/gitter-slack-bridge :v2.0.1	53eb2b3cd4cb	qs@6.5.2	6.5.3	1
halkeye/hubot :latest	9764d2202130	qs@6.5.2	6.5.3	1