StackRadarChart IndexLive demo

CVE-2025-27611

High

Advisory

Published 30 Apr 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 17; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 1 of 1; affected package

Homograph attack allows Unicode lookalike characters to bypass validation.

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
base-xnpm	3.0.8, 3.0.9, 3.0.10, 4.0.0	3.0.11, 4.0.1	14

OSV records: GHSA-xq7p-g2vc-g82p

Charts affected

17 by stars

Chart

Latest

Affected images

Radar Score

umamiwaldo-vision

1 of 1 See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :postgresql-v1.39.5	60fa8875aff8	base-x@4.0.0	4.0.1

Open the chart page →

1,255

bee-localchainethersphere

1 of 1 See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ethersphere/bee-localchain :latest	0558799ca992	base-x@3.0.9	3.0.11

Open the chart page →

2,266

bzz-token-serviceethersphere

1 of 1 See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ethersphere/bzz-token-service :latest	7624f11a72ad	base-x@3.0.8	3.0.11

Open the chart page →

3,260

geth-swapethersphere

1 of 2 See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ethersphere/bee-localchain :latest	0558799ca992	base-x@3.0.9	3.0.11

Open the chart page →

4,756

onboarding-faucetethersphere

1 of 1 See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ethersphere/onboarding-faucet :0.3.0	513154aab230	base-x@3.0.9	3.0.11

Open the chart page →

3,320

galoy-paygaloymoney

1 of 2 See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
krtk6160/galoy-nostrdigest-pinned	cc82a694f818	base-x@3.0.9	3.0.11

Open the chart page →

2,528

galoy-paygaloymoney2

1 of 2 See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
krtk6160/galoy-nostrdigest-pinned	cc82a694f818	base-x@3.0.9	3.0.11

Open the chart page →

2,528

matrix-appservice-gitterhalkeye

1 of 1 See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
matrixdotorg/matrix-appservice-gitter :latest	0d37b4d42b47	base-x@3.0.8	3.0.11

Open the chart page →

3,003

dtlinfradao

1 of 1 See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	base-x@3.0.8	3.0.11

Open the chart page →

4,944

interbtc-hydrainterlay

1 of 4 See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
interlayhq/interbtc-hydra-processor :master-2c6e16e-1637088364	423d567d47aa	base-x@3.0.9	3.0.11

Open the chart page →

6,831

interlay-firesquidinterlay

1 of 4 See more

interlay-firesquid interlay 0.1.11

1 of the 4 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
interlayhq/interbtc-hydra-processor :0.10.5	5b2c414307b9	base-x@3.0.9	3.0.11

Open the chart page →

4,667

indexer-toolsnodeify

1 of 1 See more

indexer-tools nodeify 2.1.1

1 of the 1 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
ghcr.io/vincenttaglia/indexer-tools :v3.4.4	5bae30456ddb	base-x@3.0.9	3.0.11

Open the chart page →

2,919

mishtip2p-avs

1 of 2 See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
mishtinetwork/operator :latest	bb3fe67a5f7c	base-x@3.0.10	3.0.11

Open the chart page →

3,999

ungatep2p-avs

1 of 3 See more

ungate p2p-avs 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester :latest	d0e0aa238b02	base-x@3.0.10	3.0.11

Open the chart page →

27,373

safe-stacksafe-global

1 of 9 See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
gjeanmart/safe-ganache-node :latest	926264c8f2d1	base-x@3.0.9	3.0.11

Open the chart page →

19,560

safe-transaction-servicesafe-global

1 of 6 See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
gjeanmart/safe-ganache-node :latest	926264c8f2d1	base-x@3.0.9	3.0.11

Open the chart page →

16,620

alertmanager-matrix-forwarderzloi-space

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-27611.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	base-x@3.0.8	3.0.11

Open the chart page →

3,118

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ethersphere/bee-localchain :latest	0558799ca992	base-x@3.0.9	3.0.11	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	base-x@3.0.9	3.0.11	2
krtk6160/galoy-nostr	cc82a694f818	base-x@3.0.9	3.0.11	2
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	base-x@3.0.8	3.0.11	1
ethersphere/bzz-token-service :latest	7624f11a72ad	base-x@3.0.8	3.0.11	1
ethersphere/onboarding-faucet :0.3.0	513154aab230	base-x@3.0.9	3.0.11	1
interlayhq/interbtc-hydra-processor :master-2c6e16e-1637088364	423d567d47aa	base-x@3.0.9	3.0.11	1
interlayhq/interbtc-hydra-processor :0.10.5	5b2c414307b9	base-x@3.0.9	3.0.11	1
matrixdotorg/matrix-appservice-gitter :latest	0d37b4d42b47	base-x@3.0.8	3.0.11	1
mishtinetwork/operator :latest	bb3fe67a5f7c	base-x@3.0.10	3.0.11	1
xom4ekp2p/infini-route-attestators-public-mainnet-attester :latest	d0e0aa238b02	base-x@3.0.10	3.0.11	1
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	base-x@3.0.8	3.0.11	1
ghcr.io/umami-software/umami :postgresql-v1.39.5	60fa8875aff8	base-x@4.0.0	4.0.1	1
ghcr.io/vincenttaglia/indexer-tools :v3.4.4	5bae30456ddb	base-x@3.0.9	3.0.11	1