StackRadar

CVE-2025-22872

Medium

Advisory

Published 16 Apr 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,051
of 17,803 indexed, latest versions
Container images
2,540
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/net vulnerable to Cross-site Scripting

Carried by container images the latest versions of 2,051 of 17,803 indexed charts deploy, on 2,540 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+203 more0.38.02,540
OSV records
GHSA-vvgc-356p-c3xw
Also known as
GO-2025-3595

Charts affected

2,051 by stars
ChartLatestAffected imagesRadar Score
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
0.38.0

Open the chart page →

3,700

Container images carrying it

2,540 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
gcr.io/gke-release/custom-metrics-stackdriver-adapter:v0.13.1-gke.06937c0a9b203
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.38.0
1
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
golang.org/x/net@v0.0.0-20210614182718-04defd469f4e
0.38.0
1
gcr.io/google-samples/microservices-demo/cartservice:v0.2.3566733b4d2d5
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/google-samples/microservices-demo/checkoutservice:v0.2.30fad1066de77
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/google-samples/microservices-demo/frontend:v0.2.3ca5c0f0771c8
golang.org/x/net@v0.0.0-20190628185345-da137c7871d7
0.38.0
1
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/google-samples/microservices-demo/productcatalogservice:v0.2.35a4a0e54c6d0
golang.org/x/net@v0.0.0-20190628185345-da137c7871d7
0.38.0
1
gcr.io/google-samples/microservices-demo/recommendationservice:v0.2.35f60c4988859
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/google-samples/microservices-demo/shippingservice:v0.2.30cb1707fc503
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
1
gcr.io/istio-release/pilot:1.11.1c552478f8f11
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
0.38.0
1
gcr.io/istio-release/proxyv2:1.11.19538fabe49fd
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
0.38.0
1
gcr.io/istio-testing/operator:latest8d4576f7b98f
golang.org/x/net@v0.27.0
0.38.0
1
gcr.io/k8s-staging-multitenancy/hnc-manager:v1.1.08ab8229f6a89
golang.org/x/net@v0.3.0
0.38.0
1
gcr.io/k8s-staging-sig-storage/objectstorage-controller:v20221027-v0.1.1-8-g300019fa84b574e8027
golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2
0.38.0
1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filterd675f211a40f
golang.org/x/net@v0.30.0
0.38.0
1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingressec4b544499ba
golang.org/x/net@v0.30.0
0.38.0
1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker395f4ff1bd34
golang.org/x/net@v0.30.0
0.38.0
1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook873b968f02b5
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller:v1.13.1a5b041ba3c9e
golang.org/x/net@v0.20.0
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controllere70bc675f977
golang.org/x/net@v0.30.0
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller:v1.2.0f253b82941c2
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook7d76a6d42d13
golang.org/x/net@v0.30.0
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook:v1.2.0a705c1ea8e9e
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.38.0
1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook:v1.13.1f066376eee17
golang.org/x/net@v0.20.0
0.38.0
1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier197fbb71d1f1
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook6c5c90cdf707
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activator08315309da4b
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activator1e3db4f2eeed
golang.org/x/net@v0.0.0-20200904194848-62affa334b73
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activator:v1.13.121f8e11a44bf
golang.org/x/net@v0.20.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activator:v1.2.593ff6e693577
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activatora5de0fb75046
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/activator:v1.10.2c2994c2b6c2c
golang.org/x/net@v0.7.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler:v1.2.5007820fdb75b
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler105bdd14ecaa
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler2ef460356b17
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler:v1.13.134796e9f760b
golang.org/x/net@v0.20.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler:v1.10.28319aa662b49
golang.org/x/net@v0.7.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdb6ceff2aab4
golang.org/x/net@v0.0.0-20200904194848-62affa334b73
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa:v1.10.2eb612b929eaa
golang.org/x/net@v0.7.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller30ce73388ae5
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.13.153d9aa4d2c7a
golang.org/x/net@v0.20.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.2.575cfdcfa050a
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.10.298a2cc7fd62e
golang.org/x/net@v0.7.0
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controllerb2cd45b8a8a4
golang.org/x/net@v0.0.0-20200904194848-62affa334b73
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controllerbac158dfb0c7
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/default-domain5e0429b70299
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping:v1.2.523baa1932232
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mappinge384a295069b
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping:v1.10.2f66c41ad7a73
golang.org/x/net@v0.7.0
0.38.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.