CVE-2024-43800

Medium

Advisory

Published 10 Sept 2024In the index since 5 Sept 2026

serve-static vulnerable to template injection that can lead to XSS

Carried by container images the latest versions of 353 of 17,787 indexed charts deploy, on 354 images.

Affected package	Affected versions	Fixed in	Images
serve-staticnpm	1.10.0, 1.10.2, 1.10.3, 1.12.2+6 more	1.16.0	354

353 by stars

Chart

Latest

Affected images

Radar Score

2 of the 9 container images this version deploys carry CVE-2024-43800.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	serve-static@1.15.0	1.16.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	serve-static@1.15.0	1.16.0

16,083

1 of the 1 container images this version deploys carry CVE-2024-43800.

Container image	Digest	Package	Fixed in
ymuski/skooner :latest	67819ca511b5	serve-static@1.14.1	1.16.0

1,752

1 of the 2 container images this version deploys carry CVE-2024-43800.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	serve-static@1.14.1	1.16.0

3,118

354 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/t3n/dashkiosk :v2.7.8	c973e166a5dc	serve-static@1.10.3	1.16.0	1
quay.io/wekan/wekan :v5.65	cb17600883a3	serve-static@1.10.0	1.16.0	1
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	serve-static@1.13.2	1.16.0	1
registry.gitlab.com/timvisee/send :v3.4.20	47986cf6ef69	serve-static@1.14.2	1.16.0	1