StackRadar

CVE-2025-32379

Medium

Advisory

Published 9 Apr 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.0
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
19
deployed by those charts
Fix available
1 of 1
affected package

Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 19 images.

Affected packageAffected versionsFixed inImages
koanpm2.0.0, 2.13.0, 2.13.1, 2.13.3+5 more2.16.119
OSV records
GHSA-x2rg-q646-7m2v

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
koa@2.14.2
2.16.1

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
koa@2.15.4
2.16.1

Open the chart page →

5,352
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
koa@2.13.4
2.16.1

Open the chart page →

5,251
community-solid-servercommunity-solid-server3.0.01 of 1See more

community-solid-server community-solid-server 3.0.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
solidproject/community-server:6.0.2ccc4acb7e9a1
koa@2.13.4
2.16.1

Open the chart page →

1,613
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
koa@2.14.2
2.16.1

Open the chart page →

3,925
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
koa@2.13.4
2.16.1

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
koa@2.13.4
2.16.1

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
koa@2.13.4
2.16.1

Open the chart page →

5,141
swagger-combine-uicryptexlabsVerified publisher0.2.41 of 1See more

swagger-combine-ui cryptexlabs 0.2.4

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
koa@2.13.1
2.16.1

Open the chart page →

1,378
exposrexposr0.12.01 of 1See more

exposr exposr 0.12.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
koa@2.14.1
2.16.1

Open the chart page →

570
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
koa@2.0.0
2.16.1

Open the chart page →

6,454
tampkubebb5.6.01 of 2See more

tamp kubebb 5.6.0

1 of the 2 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
kubebb/tamp-portal:v5.6.0fadac6d52470
koa@2.13.1
2.16.1

Open the chart page →

4,664
tapm-componentkubebb5.7.11 of 3See more

tapm-component kubebb 5.7.1

1 of the 3 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
refar/apm-portal:v5.7.1dcca8e4477a6
koa@2.13.1
2.16.1

Open the chart page →

10,264
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
kubebb/tdsf-portal:v5.7.0258458311bc9
koa@2.13.4
2.16.1

Open the chart page →

6,490
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
koa@2.13.3
2.16.1

Open the chart page →

9,968
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
koa@2.15.2
2.16.1

Open the chart page →

7,413
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
koa@2.13.4
2.16.1

Open the chart page →

5,582
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
koa@2.14.2
2.16.1

Open the chart page →

4,431
alertmanager-to-alerta-botsomeblackmagic0.2.01 of 1See more

alertmanager-to-alerta-bot someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
koa@2.13.4
2.16.1

Open the chart page →

2,121
alert-mappersomeblackmagic0.2.01 of 1See more

alert-mapper someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
someblackmagic/alert-mapper:v0.1.088351d85c04c
koa@2.13.4
2.16.1

Open the chart page →

1,890
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
koa@2.13.1
2.16.1

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2025-32379.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
koa@2.13.0
2.16.1

Open the chart page →

22,665

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
rcdelacruz/my-strapi-app:js-amd6438007f358355
koa@2.13.4
2.16.1
3
outlinewiki/outline:0.69.1d060dcd8f9aa
koa@2.14.2
2.16.1
2
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
koa@2.13.1
2.16.1
1
jayfong/yapi:1.10.2163e5d621910
koa@2.0.0
2.16.1
1
joplin/server:3.0-beta52af57880c0e
koa@2.15.2
2.16.1
1
joplin/server:2.14.2-betab87564ef34e9
koa@2.14.2
2.16.1
1
kubebb/tamp-portal:v5.6.0fadac6d52470
koa@2.13.1
2.16.1
1
kubebb/tdsf-portal:v5.7.0258458311bc9
koa@2.13.4
2.16.1
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
koa@2.13.4
2.16.1
1
misskey/misskey:12.110.1e08b7c478093
koa@2.13.4
2.16.1
1
outlinewiki/outline:0.82.0494dfb9249a6
koa@2.15.4
2.16.1
1
refar/apm-portal:v5.7.1dcca8e4477a6
koa@2.13.1
2.16.1
1
solidproject/community-server:6.0.2ccc4acb7e9a1
koa@2.13.4
2.16.1
1
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
koa@2.13.4
2.16.1
1
someblackmagic/alert-mapper:v0.1.088351d85c04c
koa@2.13.4
2.16.1
1
temporalio/web:1.14.033cfa863d8ce
koa@2.13.0
2.16.1
1
ubercadence/web:v3.29.58564a5b44a6d
koa@2.13.1
2.16.1
1
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
koa@2.14.1
2.16.1
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
koa@2.13.3
2.16.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.