StackRadar

CVE-2022-29078

Critical

Advisory

Published 26 Apr 2022In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.328
98th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
54
of 17,781 indexed, latest versions
Container images
48
deployed by those charts
Fix available
1 of 1
affected package

ejs template injection vulnerability

Carried by container images the latest versions of 54 of 17,781 indexed charts deploy, on 48 images.

Affected packageAffected versionsFixed inImages
ejsnpm0.8.8, 1.0.0, 2.3.4, 2.5.6+7 more3.1.748
OSV records
GHSA-phwq-j96m-2c2q

Charts affected

54 by stars
ChartLatestAffected imagesRadar Score
vehicle-dashboardtest-vehi-dash0.1.02 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

2 of the 7 container images this version deploys carry CVE-2022-29078.

Container imageDigestPackageFixed in
samajh/alprbackend:latestea742b4372ad
ejs@2.7.4
3.1.7
samajh/alprfrontend:latest05ef4fddbb75
ejs@2.7.4
3.1.7

Open the chart page →

20,270
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2022-29078.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
ejs@3.1.6
3.1.7

Open the chart page →

3,576
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-29078.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
ejs@3.1.6
3.1.7

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-29078.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
ejs@3.1.6
3.1.7

Open the chart page →

28,605

Container images carrying it

48 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
ejs@2.7.4
3.1.7
3
pantsel/konga:latestc8172b75607d
ejs@0.8.8
3.1.7
3
hookiesolutions/webhookie:latest0629694246ba
ejs@3.1.6
3.1.7
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
ejs@2.7.4
3.1.7
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
ejs@2.7.4
3.1.7
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
ejs@2.7.4
3.1.7
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
ejs@2.7.4
3.1.7
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
ejs@2.7.4
3.1.7
2
statsd/statsd:v0.8.6dab129e74c25
ejs@2.7.4
3.1.7
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
ejs@2.7.4
3.1.7
2
arfath29/3-tier-app-frontend:latest384b3e377f47
ejs@2.7.4
3.1.7
1
catalysm/csmm:latestf003b35f54d9
ejs@3.1.6
3.1.7
1
conduction/conduction-ui-app:devd591f5e6f2a9
ejs@2.7.4
3.1.7
1
fiware/idm:8.3.3a1b6ed4ae84f
ejs@2.7.4
3.1.7
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
ejs@2.7.1
3.1.7
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
ejs@2.6.2
3.1.7
1
gristlabs/grist:0.7.96e71b1914a7e
ejs@2.7.4
3.1.7
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
ejs@3.0.1
3.1.7
1
ibmcom/app-nav-ui:1.0.1e2a86997b36b
ejs@2.6.2
3.1.7
1
ibmcom/microclimate-portal:latested5505e5c7ec
ejs@2.5.8
3.1.7
1
jayfong/yapi:1.10.2163e5d621910
ejs@2.3.4
3.1.7
1
kubebb/tamp-portal:v5.6.0fadac6d52470
ejs@2.7.4
3.1.7
1
kubebb/tdsf-portal:v5.7.0258458311bc9
ejs@2.7.4
3.1.7
1
lavandadelpatio/frontend:latest501c3f31e0bc
ejs@2.7.4
3.1.7
1
library/ghost:4.37.0767230c0f263
ejs@3.1.6
3.1.7
1
linuxserver/calibre:version-v5.21.0a847b5b2d860
ejs@2.7.4
3.1.7
1
linuxserver/cloud9:latest45c5fe102ff3
ejs@1.0.0
3.1.7
1
linuxserver/codimd:latestb801bbcf6386
ejs@2.7.4
3.1.7
1
lissy93/dashy:2.0.51991f7be5ed0
ejs@2.7.4
3.1.7
1
misskey/misskey:12.110.1e08b7c478093
ejs@3.1.6
3.1.7
1
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
ejs@2.7.4
3.1.7
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
ejs@3.1.6
3.1.7
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
ejs@0.8.8
3.1.7
1
phntom/codimd:2.4.31b9aafbb62e6
ejs@2.6.2
3.1.7
1
refar/apm-portal:v5.7.1dcca8e4477a6
ejs@2.7.4
3.1.7
1
samajh/alprbackend:latestea742b4372ad
ejs@2.7.4
3.1.7
1
samajh/alprfrontend:latest05ef4fddbb75
ejs@2.7.4
3.1.7
1
shinobisystems/shinobi:dev3ca746937856
ejs@2.7.4
3.1.7
1
shinobisystems/shinobi:latestc2f5ce2e1067
ejs@2.7.4
3.1.7
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
ejs@3.1.6
3.1.7
1
testhubio/testhub-frontend:on-preme86c2db53be8
ejs@2.7.4
3.1.7
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
ejs@3.1.6
3.1.7
1
youssef11gaber10/deployment-ui-react:latestba6853e35c60
ejs@3.1.6
3.1.7
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
ejs@3.1.6
3.1.7
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
ejs@2.6.1
3.1.7
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
ejs@3.1.6
3.1.7
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
ejs@2.7.4
3.1.7
1
quay.io/wekan/wekan:v5.65cb17600883a3
ejs@2.5.6
3.1.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.