StackRadar

CVE-2024-36361

Medium

Advisory

Published 24 May 2024In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
27
of 17,781 indexed, latest versions
Container images
27
deployed by those charts
Fix available
2 of 2
affected packages

Pug allows JavaScript code execution if an application accepts untrusted input

Carried by container images the latest versions of 27 of 17,781 indexed charts deploy, on 27 images.

Affected packageAffected versionsFixed inImages
pugnpm1.0.0, 1.39.1-prel, 2.0.3, 2.0.4+2 more3.0.327
pug-code-gennpm2.0.1, 2.0.3, 3.0.1, 3.0.23.0.322
OSV records
GHSA-3965-hpx2-q597

Charts affected

27 by stars
ChartLatestAffected imagesRadar Score
code-serverdeploy-code-server1.0.31 of 2See more

code-server deploy-code-server 1.0.3

1 of the 2 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
codercom/code-server:3.10.247605610ad8d
pug@1.0.0
3.0.3

Open the chart page →

4,577
servarrservarr1.0.21 of 10See more

servarr servarr 1.0.2

1 of the 10 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

14,238
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

5,251
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

5,946
code-serveralekcVerified publisher0.1.11 of 1See more

code-server alekc 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
linuxserver/code-server:4.10.1a5e43a05ae79
pug@1.0.0
3.0.3

Open the chart page →

8,212
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

18,517
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

2,702
overseerrgeek-cookbookVerified publisher5.4.21 of 1See more

overseerr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.26.1254d16af8f71
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

3,444
pdc-portali4trustVerified publisher2.3.21 of 1See more

pdc-portal i4trust 2.3.2

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
i4trust/pdc-portal:2.0.03e77858e1219
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

2,723
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
pug@1.0.0
3.0.3

Open the chart page →

31,844
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

3,437
overseerrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

overseerr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
linuxserver/overseerr:1.35.06108ed066d4a
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

3,071
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pug@1.0.0
3.0.3

Open the chart page →

14,559
ethstatsethereum-helm-chartsVerified publisher0.1.41 of 1See more

ethstats ethereum-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
skylenet/ethstats-server:pow-latestd757cc016198
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

1,109
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
pug@1.39.1-prel
3.0.3

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
pug@1.39.1-prel
3.0.3

Open the chart page →

24,319
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

25,017
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

4,253
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

2,363
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

4,230
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

5,410
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
pug@2.0.3
pug-code-gen@2.0.1
3.0.3
3.0.3

Open the chart page →

7,929
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

9,774
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
pug@3.0.0
pug-code-gen@3.0.1
3.0.3
3.0.3

Open the chart page →

6,684
smilencsaVerified publisher1.1.02 of 23See more

smile ncsa 1.1.0

2 of the 23 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
pug@2.0.4
pug-code-gen@2.0.3
3.0.3
3.0.3
socialmediamacroscope/smile_server:0.3.31a528c794270
pug@2.0.3
pug-code-gen@2.0.3
3.0.3
3.0.3

Open the chart page →

109,294
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

4,017
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2024-36361.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3

Open the chart page →

3,129

Container images carrying it

27 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
governify/assets-manager:v1.4.12987672448c7
pug@1.39.1-prel
3.0.3
2
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
pug@2.0.3
pug-code-gen@2.0.1
3.0.3
3.0.3
1
codercom/code-server:4.11.0-debian1e2cc688008e
pug@1.0.0
3.0.3
1
codercom/code-server:3.10.247605610ad8d
pug@1.0.0
3.0.3
1
enketo/enketo-express:3.0.4dcad9c2273f6
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
i4trust/pdc-portal:2.0.03e77858e1219
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
keyoxide/keyoxide:stable96f27a71269d
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
linuxserver/code-server:4.10.1a5e43a05ae79
pug@1.0.0
3.0.3
1
linuxserver/overseerr:1.35.06108ed066d4a
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
misskey/misskey:12.110.1e08b7c478093
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
mozilla/sentencecollector:2.0.91da6ff5c4895
pug@3.0.0
pug-code-gen@3.0.1
3.0.3
3.0.3
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
openbas/caldera-server:5.1.0a277796d9724
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
polonel/trudesk:1.2.60cf6513f6fe3
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
requarks/wiki:canary-2.5.2438b5865a7386c
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
skylenet/ethstats-server:pow-latestd757cc016198
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
pug@2.0.4
pug-code-gen@2.0.3
3.0.3
3.0.3
1
socialmediamacroscope/smile_server:0.3.31a528c794270
pug@2.0.3
pug-code-gen@2.0.3
3.0.3
3.0.3
1
stanfordoval/almond-server:latest1a63cdccedaf
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pug@1.0.0
3.0.3
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
pug@3.0.2
pug-code-gen@3.0.2
3.0.3
3.0.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.