StackRadarChart IndexLive demo

CVE-2025-54419

Critical

Advisory

Published 28 Jul 2025In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 10.0; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 14; of 17,781 indexed, latest versions
Container images: 11; deployed by those charts
Fix available: 2 of 3; affected packages

Node-SAML SAML Signature Verification Vulnerability

Carried by container images the latest versions of 14 of 17,781 indexed charts deploy, on 11 images.

Affected package	Affected versions	Fixed in	Images
passport-samlnpm	1.0.0, 1.3.3, 1.3.5, 1.5.0+4 more	no fix listed	9
@node-saml/node-samlnpm	4.0.5	5.1.0	2
@node-saml/passport-samlnpm	4.0.4	5.1.0	2

OSV records: GHSA-4mxg-3p6v-xgq3

Charts affected

14 by stars

Chart

Latest

Affected images

Radar Score

backstagedeliveryhero

1 of 2 See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	passport-saml@1.3.3	no fix listed

Open the chart page →

8,213

wikijsgeek-cookbook

1 of 1 See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	passport-saml@1.3.5	no fix listed

Open the chart page →

5,946

wikiwenerme

1 of 2 See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
requarks/wiki :latest	68f0d1848261	passport-saml@3.2.4	no fix listed

Open the chart page →

3,833

backstagehelm-charts-nr

1 of 2 See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	passport-saml@1.3.3	no fix listed

Open the chart page →

8,213

automatischhelmforge

1 of 4 See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
automatischio/automatisch :0.15.0	3bace7a12d5f	@node-saml/node-saml@4.0.5 @node-saml/passport-saml@4.0.4	5.1.0 5.1.0

Open the chart page →

5,769

wikijshomeenterpriseinc

1 of 1 See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
requarks/wiki :canary-2.5.243	8b5865a7386c	passport-saml@1.3.5	no fix listed

Open the chart page →

4,253

backstageirembo-backstage-helm

1 of 3 See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
roadiehq/community-backstage-image :latest	ef355bf5b639	passport-saml@2.0.5	no fix listed

Open the chart page →

7,232

sqlpadkronkltd

1 of 1 See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
sqlpad/sqlpad :6.7	d3d2f430dffd	passport-saml@2.2.0	no fix listed

Open the chart page →

3,397

backstagemcwarman

1 of 2 See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@node-saml/node-saml@4.0.5 @node-saml/passport-saml@4.0.4	5.1.0 5.1.0

Open the chart page →

9,668

example-dev-toolsnoygal

1 of 3 See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
linuxserver/codimd :latest	b801bbcf6386	passport-saml@1.5.0	no fix listed

Open the chart page →

27,465

codimdphntom

1 of 3 See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
phntom/codimd :2.4.3	1b9aafbb62e6	passport-saml@1.0.0	no fix listed

Open the chart page →

6,524

hedgedocschmitzis

1 of 1 See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	passport-saml@3.2.1	no fix listed

Open the chart page →

3,118

1 of 1 See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	passport-saml@3.2.1	no fix listed

Open the chart page →

3,118

wikiwikijs

1 of 2 See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2025-54419.

Container image	Digest	Package	Fixed in
requarks/wiki :2	68f0d1848261	passport-saml@3.2.4	no fix listed

Open the chart page →

5,459

Container images carrying it

11 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	passport-saml@1.3.3	no fix listed	2
requarks/wiki :2 :latest	68f0d1848261	passport-saml@3.2.4	no fix listed	2
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	passport-saml@3.2.1	no fix listed	2
automatischio/automatisch :0.15.0	3bace7a12d5f	@node-saml/node-saml@4.0.5 @node-saml/passport-saml@4.0.4	5.1.0 5.1.0	1
linuxserver/codimd :latest	b801bbcf6386	passport-saml@1.5.0	no fix listed	1
phntom/codimd :2.4.3	1b9aafbb62e6	passport-saml@1.0.0	no fix listed	1
requarks/wiki :canary-2.5.243	8b5865a7386c	passport-saml@1.3.5	no fix listed	1
roadiehq/community-backstage-image :latest	ef355bf5b639	passport-saml@2.0.5	no fix listed	1
sqlpad/sqlpad :6.7	d3d2f430dffd	passport-saml@2.2.0	no fix listed	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	passport-saml@1.3.5	no fix listed	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	@node-saml/node-saml@4.0.5 @node-saml/passport-saml@4.0.4	5.1.0 5.1.0	1