StackRadar

CVE-2025-22872

Medium

Advisory

Published 16 Apr 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,051
of 17,803 indexed, latest versions
Container images
2,540
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/net vulnerable to Cross-site Scripting

Carried by container images the latest versions of 2,051 of 17,803 indexed charts deploy, on 2,540 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+203 more0.38.02,540
OSV records
GHSA-vvgc-356p-c3xw
Also known as
GO-2025-3595

Charts affected

2,051 by stars
ChartLatestAffected imagesRadar Score
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
0.38.0

Open the chart page →

3,700

Container images carrying it

2,540 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
golang.org/x/net@v0.23.0
0.38.0
1
ghcr.io/okteto/buildkit:0.0.0-2026-08-03:0.0.0-2026-08-1714527ca5d2a9
golang.org/x/net@v0.35.0
0.38.0
1
ghcr.io/oliverbaehler/cloudflare-tunnel-ingress-controller:0.2.30aec31e36d95
golang.org/x/net@v0.37.0
0.38.0
1
ghcr.io/olivetin/olivetin:2025.2.19a89958921526
golang.org/x/net@v0.33.0
0.38.0
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
golang.org/x/net@v0.14.0
0.38.0
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
golang.org/x/net@v0.19.0
0.38.0
1
ghcr.io/openclarity/kubeclarity-sbom-db:v2.23.3cef2b88bfc76
golang.org/x/net@v0.17.0
0.38.0
1
ghcr.io/openfaas/faas-netes:0.18.1224431adc8e2d
golang.org/x/net@v0.32.0
0.38.0
1
ghcr.io/openfaasltd/gcp-pubsub-connector:0.0.18df071f5b719
golang.org/x/net@v0.35.0
0.38.0
1
ghcr.io/openfaas/mqtt-connector:0.4.33311a30b8fe6
golang.org/x/net@v0.0.0-20200425230154-ff2c4b7c35a0
0.38.0
1
ghcr.io/open-feature/flagd:v0.11.1a7ea52f87446
golang.org/x/net@v0.27.0
0.38.0
1
ghcr.io/openstack-exporter/openstack-exporter:1.7.0e5146a7dd515
golang.org/x/net@v0.10.0
0.38.0
1
ghcr.io/open-telemetry/demo:1.12.0-productcatalogservice008b9b662289
golang.org/x/net@v0.25.0
0.38.0
1
ghcr.io/open-telemetry/demo:1.12.0-checkoutservice380eccdc29e9
golang.org/x/net@v0.25.0
0.38.0
1
ghcr.io/open-telemetry/demo:1.12.0-shippingservicea3ca4c02a5df
golang.org/x/net@v0.19.0
0.38.0
1
ghcr.io/ot-container-kit/redis-operator/redis-operator:v0.18.090bfeb2e0d71
golang.org/x/net@v0.24.0
0.38.0
1
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
golang.org/x/net@v0.0.0-20200301022130-244492dfa37a
0.38.0
1
ghcr.io/parca-dev/parca-agent:v0.28.06d6794f45f3e
golang.org/x/net@v0.19.0
0.38.0
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
0.38.0
1
ghcr.io/performancecopilot/archive-analysis:latest8de11e2363fc
golang.org/x/net@v0.19.0
0.38.0
1
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
golang.org/x/net@v0.26.0
0.38.0
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582
0.38.0
1
ghcr.io/predicatelabs/operator:v1.0.5b62113fe1b27
golang.org/x/net@v0.33.0
0.38.0
1
ghcr.io/privacyengineering/consumer:main73f59c032812
golang.org/x/net@v0.0.0-20211029224645-99673261e6eb
0.38.0
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
golang.org/x/net@v0.19.0
0.38.0
1
ghcr.io/projectcapsule/capsule-addon-fluxcd:0.2.2e0baf564b706
golang.org/x/net@v0.32.0
0.38.0
1
ghcr.io/projectcontour/contour:v1.30.0b12824d7eb58
golang.org/x/net@v0.26.0
0.38.0
1
ghcr.io/prymitive/karma:v0.85d06892218680
golang.org/x/net@v0.0.0-20210503060351-7fd8e65b6420
0.38.0
1
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
golang.org/x/net@v0.20.0
0.38.0
1
ghcr.io/puckpuck/seashell:1.2ef5e31333821
golang.org/x/net@v0.0.0-20201021035429-f5854403a974
0.38.0
1
ghcr.io/pulumi/pulumi-esc-csi-provider:0.1.13fb058e93502
golang.org/x/net@v0.32.0
0.38.0
1
ghcr.io/punchplatform/operator:8.1-dev2a9536c8cee2
golang.org/x/net@v0.20.0
0.38.0
1
ghcr.io/pyrra-dev/pyrra:v0.8.10e02ef538ef0
golang.org/x/net@v0.31.0
0.38.0
1
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
golang.org/x/net@v0.2.0
0.38.0
1
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
golang.org/x/net@v0.0.0-20220401154927-543a649e0bdd
0.38.0
1
ghcr.io/riverqueue/riverui:0.5.32dc54179b25a
golang.org/x/net@v0.23.0
0.38.0
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
golang.org/x/net@v0.23.0
0.38.0
1
ghcr.io/salesforce/kubelet-summary-exporter:sha-c2bf90d377e09d2dd72
golang.org/x/net@v0.8.0
0.38.0
1
ghcr.io/salesforce/sloop:sha-2ce8bbe119e24f24b1d
golang.org/x/net@v0.0.0-20200625001655-4c5254603344
0.38.0
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
golang.org/x/net@v0.30.0
0.38.0
1
ghcr.io/schmitzis/cert-manager-webhook-bunny:latest125e31c8e85a
golang.org/x/net@v0.5.0
0.38.0
1
ghcr.io/sergelogvinov/keydb:6.3.376a19ddc3626
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
0.38.0
1
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
golang.org/x/net@v0.27.0
0.38.0
1
ghcr.io/shift/domain_exporter:v0.1.1347e27690a816
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.38.0
1
ghcr.io/siderolabs/talos-backup:v0.1.0-beta.203a71e140f1d
golang.org/x/net@v0.26.0
0.38.0
1
ghcr.io/sintef/cert-manager-webhook-gandi:0.6.06819b34ccac8
golang.org/x/net@v0.26.0
0.38.0
1
ghcr.io/snapp-incubator/health-exporter:0.3.252a0d8f6278c
golang.org/x/net@v0.0.0-20210913180222-943fd674d43e
0.38.0
1
ghcr.io/spidernet-io/egressgateway-agent:v0.6.9a8ec2f74c9d0
golang.org/x/net@v0.33.0
0.38.0
1
ghcr.io/spidernet-io/egressgateway-controller:v0.6.99deda7b68c34
golang.org/x/net@v0.33.0
0.38.0
1
ghcr.io/spiffe/spiffe-csi-driver:0.2.34144101005b2
golang.org/x/net@v0.7.0
0.38.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.