StackRadar

CVE-2024-43800

Medium

Advisory

Published 10 Sept 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.0
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
354
of 17,781 indexed, latest versions
Container images
355
deployed by those charts
Fix available
1 of 1
affected package

serve-static vulnerable to template injection that can lead to XSS

Carried by container images the latest versions of 354 of 17,781 indexed charts deploy, on 355 images.

Affected packageAffected versionsFixed inImages
serve-staticnpm1.10.0, 1.10.2, 1.10.3, 1.12.2+6 more1.16.0355
OSV records
GHSA-cm22-4g7w-348p

Charts affected

354 by stars
ChartLatestAffected imagesRadar Score
playwright-synthetic-monitoringwork-adventure1.0.11 of 1See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2024-43800.

Container imageDigestPackageFixed in
workadventure/playwright-synthetic-monitoring:main92b664c2a06f
serve-static@1.15.0
1.16.0

Open the chart page →

14,100
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2024-43800.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
serve-static@1.15.0
1.16.0
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
serve-static@1.15.0
1.16.0

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-43800.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
serve-static@1.14.1
1.16.0

Open the chart page →

1,752
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2024-43800.

Container imageDigestPackageFixed in
zl0i/alertmanager-matrix-forwarder:v1.0.0e94047931739
serve-static@1.14.1
1.16.0

Open the chart page →

3,118

Container images carrying it

355 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
serve-static@1.14.1
1.16.0
1
ghcr.io/0xemma/reddark:main2a115e991894
serve-static@1.15.0
1.16.0
1
ghcr.io/advplyr/audiobookshelf:2.0.3140aed2752c3
serve-static@1.14.2
1.16.0
1
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
serve-static@1.15.0
1.16.0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
serve-static@1.15.0
1.16.0
1
ghcr.io/beluga-cloud/actual/actualserver:23.12.1c8a0d5ec5a12
serve-static@1.15.0
1.16.0
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
serve-static@1.15.0
1.16.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
serve-static@1.14.1
1.16.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
serve-static@1.14.1
1.16.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
serve-static@1.14.1
1.16.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
serve-static@1.14.1
1.16.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
serve-static@1.15.0
1.16.0
1
ghcr.io/data-fair/metrics:0a8d40779eeae
serve-static@1.15.0
1.16.0
1
ghcr.io/data-fair/processings:15a9216989707
serve-static@1.15.0
1.16.0
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
serve-static@1.15.0
1.16.0
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
serve-static@1.14.1
1.16.0
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
serve-static@1.15.0
1.16.0
1
ghcr.io/k10app/basicuserservice:latest2ee057ad3bef
serve-static@1.15.0
1.16.0
1
ghcr.io/k10app/catalog:latest639c980be0f1
serve-static@1.15.0
1.16.0
1
ghcr.io/k10app/order:lateste1017d0dbd78
serve-static@1.15.0
1.16.0
1
ghcr.io/kubedb/mongo-gui:latestee0354b7a57a
serve-static@1.14.1
1.16.0
1
ghcr.io/leoquote/mergeable:latest451706815103
serve-static@1.14.1
1.16.0
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
serve-static@1.14.1
1.16.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
serve-static@1.14.1
1.16.0
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
serve-static@1.15.0
1.16.0
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
serve-static@1.14.1
1.16.0
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
serve-static@1.15.0
1.16.0
1
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
serve-static@1.15.0
1.16.0
1
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
serve-static@1.15.0
1.16.0
1
ghcr.io/mmontes11/iot-thing:v3.11.0542e91e8499c
serve-static@1.15.0
1.16.0
1
ghcr.io/mrprimate/ddb-proxy:0.0.258dc2d7fb460f
serve-static@1.15.0
1.16.0
1
ghcr.io/pabloromeo/clusterplex_orchestrator:1.4.160fe80de2d22c
serve-static@1.15.0
1.16.0
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
serve-static@1.15.0
1.16.0
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
serve-static@1.15.0
1.16.0
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
serve-static@1.14.1
1.16.0
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
serve-static@1.15.0
1.16.0
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
serve-static@1.15.0
1.16.0
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
serve-static@1.15.0
1.16.0
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
serve-static@1.15.0
1.16.0
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
serve-static@1.15.0
1.16.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
serve-static@1.15.0
1.16.0
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
serve-static@1.15.0
1.16.0
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
serve-static@1.15.0
1.16.0
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
serve-static@1.15.0
1.16.0
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
serve-static@1.13.2
1.16.0
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
serve-static@1.14.1
1.16.0
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
serve-static@1.13.2
1.16.0
1
quay.io/ibmgaragecloud/slack-notifications:latest041df93e2bac
serve-static@1.14.1
1.16.0
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
serve-static@1.14.1
1.16.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
serve-static@1.14.1
1.16.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.