StackRadar

CVE-2025-5889

Low

Advisory

Published 9 Jun 2025In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.1
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
727
of 17,787 indexed, latest versions
Container images
765
deployed by those charts
Fix available
1 of 2
affected packages

brace-expansion Regular Expression Denial of Service vulnerability

Carried by container images the latest versions of 727 of 17,787 indexed charts deploy, on 765 images.

Affected packageAffected versionsFixed inImages
brace-expansionnpm1.1.1, 1.1.2, 1.1.4, 1.1.6+5 more1.1.12, 2.0.2765
node-brace-expansiondeb1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1no fix listed5
OSV records
GHSA-v6h2-p8h4-qcjwUBUNTU-CVE-2025-5889

Charts affected

727 by stars
ChartLatestAffected imagesRadar Score
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
brace-expansion@2.0.1
2.0.2

Open the chart page →

5,142
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
brace-expansion@2.0.1
2.0.2

Open the chart page →

5,142
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
brace-expansion@2.0.1
2.0.2

Open the chart page →

5,142
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
conduction/conduction-ui-app:devd591f5e6f2a9
brace-expansion@1.1.11
1.1.12

Open the chart page →

12,906
containers-security-chartscontainers-security0.1.02 of 7See more

containers-security-charts containers-security 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
coldatom/containers-security-api:latesteae9e82da080
brace-expansion@2.0.1
2.0.2
coldatom/containers-security-front:latest7c2fbbb41bcf
brace-expansion@2.0.1
2.0.2

Open the chart page →

9,146
conversor-temperaturaconversor-temperaturaVerified publisher0.1.01 of 1See more

conversor-temperatura conversor-temperatura 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
felipecs8/conversor-temperatura:v1f945423be36d
brace-expansion@2.0.1
2.0.2

Open the chart page →

1,527
cortezacorteza1.1.01 of 3See more

corteza corteza 1.1.0

1 of the 3 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
cortezaproject/corteza-server-corredor:2024.9.44ea78dfe5364
brace-expansion@1.1.11
1.1.12

Open the chart page →

8,251
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
brace-expansion@2.0.1
2.0.2

Open the chart page →

14,587
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
brace-expansion@1.1.11
1.1.12

Open the chart page →

5,489
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
brace-expansion@1.1.8
1.1.12

Open the chart page →

5,209
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
brace-expansion@1.1.11
1.1.12

Open the chart page →

3,769
swagger-combine-uicryptexlabsVerified publisher0.2.41 of 1See more

swagger-combine-ui cryptexlabs 0.2.4

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
brace-expansion@2.0.1
2.0.2

Open the chart page →

1,378
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.4.11787550d2358
brace-expansion@1.1.11
1.1.12

Open the chart page →

13,937
myawesomeappcuriousgeekshelmfirstapp0.1.21 of 1See more

myawesomeapp curiousgeekshelmfirstapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
srini78/nodejswebappeks:latest5d1cbdc6833a
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,267
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
brace-expansion@2.0.1
2.0.2

Open the chart page →

6,226
db-operatordb-operatorVerified publisher0.1.01 of 1See more

db-operator db-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
plumdog/db-operator:latest0c2fa2db0357
brace-expansion@1.1.11
1.1.12

Open the chart page →

3,042
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
defactops/defactops-backend:1.0.2307b663c0092a
brace-expansion@2.0.1
2.0.2

Open the chart page →

4,353
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,924
demo-multiclust-chartdemo-model-chart1.0.02 of 3See more

demo-multiclust-chart demo-model-chart 1.0.0

2 of the 3 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
gtato/demo-multiclus-registrator:1.0.09a744588fab3
brace-expansion@1.1.11
1.1.12
gtato/demo-multiclus-registry:1.0.02df5174f3cfd
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,770
deploy-elibrarydeploy-elibrary-helm0.1.01 of 1See more

deploy-elibrary deploy-elibrary-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
psorab/elibrary:latest53b68896c4ce
brace-expansion@2.0.1
2.0.2

Open the chart page →

7,259
deploy-elibrarydeploy-elibrary-oo0.1.01 of 1See more

deploy-elibrary deploy-elibrary-oo 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
jedi132000/nextapp:latestdc2a81e92f23
brace-expansion@1.1.11
1.1.12

Open the chart page →

8,154
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
brace-expansion@2.0.1
2.0.2

Open the chart page →

2,530
backend-servicedev-krishan-dhaka-charts1.0.31 of 1See more

backend-service dev-krishan-dhaka-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
devkrishan001/backend:latestf1c3acadeabe
brace-expansion@2.0.1
2.0.2

Open the chart page →

1,265
apachedevops0.1.01 of 4See more

apache devops 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
brace-expansion@2.0.1
2.0.2

Open the chart page →

30,150
laraveldevops0.10.31 of 4See more

laravel devops 0.10.3

1 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
brace-expansion@2.0.1
2.0.2

Open the chart page →

29,151
dgraphdevtron0.0.201 of 1See more

dgraph devtron 0.0.20

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
dgraph/dgraph:v21.12.03b55ea83fffe
brace-expansion@1.1.11
1.1.12

Open the chart page →

11,957
dgraphdevtron-labs0.0.201 of 1See more

dgraph devtron-labs 0.0.20

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
dgraph/dgraph:v21.12.03b55ea83fffe
brace-expansion@1.1.11
1.1.12

Open the chart page →

11,957
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.02 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
brace-expansion@1.1.11
1.1.12
oscarsotosanchez/weatherservice:v1.0911ec961d10b
brace-expansion@1.1.11
1.1.12

Open the chart page →

27,608
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
langgenius/dify-sandbox:0.2.009b7e8705673
brace-expansion@2.0.1
2.0.2
langgenius/dify-web:1.0.0d64914ff0d6d
brace-expansion@2.0.1
2.0.2

Open the chart page →

19,063
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
brace-expansion@2.0.1
2.0.2

Open the chart page →

4,551
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
brace-expansion@2.0.1
2.0.2

Open the chart page →

4,217
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
brace-expansion@2.0.1
2.0.2

Open the chart page →

2,862
mergeabledoubanVerified publisher0.2.21 of 1See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/leoquote/mergeable:latest451706815103
brace-expansion@1.1.11
1.1.12

Open the chart page →

4,223
eoloplannerdreyg-jescribanob-chart-eoloplanner0.1.02 of 7See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
brace-expansion@1.1.11
1.1.12
oscarsotosanchez/weatherservice:v1.0911ec961d10b
brace-expansion@1.1.11
1.1.12

Open the chart page →

24,714
dumpstoredumpstore0.1.12 of 2See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
brace-expansion@2.0.1
2.0.2
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
brace-expansion@1.1.11
1.1.12

Open the chart page →

4,253
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
brace-expansion@1.1.11
1.1.12

Open the chart page →

11,174
dyff-frontenddyff-frontendVerified publisher0.20.11 of 1See more

dyff-frontend dyff-frontend 0.20.1

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
brace-expansion@2.0.1
2.0.2

Open the chart page →

973
self-orchestratoreclipse-aeriosVerified publisher1.2.01 of 1See more

self-orchestrator eclipse-aerios 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
eclipseaerios/self-orchestrator:1.2.08b123bec5679
brace-expansion@2.0.1
2.0.2

Open the chart page →

2,397
dashboardedu1.0.01 of 1See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
sysnet4admin/dashboard:bluec5bd3bb1b5a6
brace-expansion@2.0.1
2.0.2

Open the chart page →

1,344
deploy-elibraryeducative-helm-bookapp0.5.01 of 1See more

deploy-elibrary educative-helm-bookapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
maksymhencha/educative-helm-bookapp:0.0.27f096a681192
brace-expansion@1.1.11
1.1.12

Open the chart page →

5,150
backend-charteks-3-tier-app-chart0.1.01 of 1See more

backend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
arfath29/3-tier-app-backend:latestee0750b18406
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,693
frontend-charteks-3-tier-app-chart0.1.01 of 1See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
arfath29/3-tier-app-frontend:latest384b3e377f47
brace-expansion@1.1.11
1.1.12

Open the chart page →

3,745
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
library/node:18-alpine8d6421d663b4
brace-expansion@2.0.1
2.0.2

Open the chart page →

2,960
reddarkemmas-chartsVerified publisher0.0.21 of 1See more

reddark emmas-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ghcr.io/0xemma/reddark:main2a115e991894
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,998
eolicplantseolicplantsVerified publisher0.1.02 of 7See more

eolicplants eolicplants 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
brace-expansion@1.1.11
1.1.12
oscarsotosanchez/weatherservice:v1.0911ec961d10b
brace-expansion@1.1.11
1.1.12

Open the chart page →

27,349
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.02 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
oscarsotosanchez/server:v1.06e2e1279126b
brace-expansion@1.1.11
1.1.12
oscarsotosanchez/weatherservice:v1.0911ec961d10b
brace-expansion@1.1.11
1.1.12

Open the chart page →

27,314
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
arturisimo/server-urjc:v1.0d8dc4430531e
brace-expansion@1.1.11
1.1.12

Open the chart page →

27,188
edp-installepmdedpOfficialVerified publisher3.15.01 of 7See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
brace-expansion@2.0.1
2.0.2

Open the chart page →

2,034
krci-portalepmdedpVerified publisher0.8.01 of 1See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
epamedp/krci-portal:0.8.0687acf641097
brace-expansion@2.0.1
2.0.2

Open the chart page →

839
blobscanethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-5889.

Container imageDigestPackageFixed in
ethpandaops/blobscan:latest7a9ab6370657
brace-expansion@1.1.11
1.1.12

Open the chart page →

1,329

Container images carrying it

765 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
brace-expansion@1.1.11
1.1.12
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
brace-expansion@1.1.8
1.1.12
1
quay.io/seamware/fdsc-dashboard:0.6.0f7706c316c5a
brace-expansion@2.0.1
2.0.2
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
brace-expansion@2.0.1
2.0.2
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
brace-expansion@1.1.11
1.1.12
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
brace-expansion@2.0.1
2.0.2
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
brace-expansion@1.1.11
1.1.12
1
quay.io/wekan/wekan:v5.65cb17600883a3
brace-expansion@1.1.11
1.1.12
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
brace-expansion@2.0.1
2.0.2
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
brace-expansion@2.0.1
2.0.2
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
brace-expansion@2.0.1
2.0.2
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
brace-expansion@1.1.11
1.1.12
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
brace-expansion@1.1.11
1.1.12
1
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
brace-expansion@1.1.11
1.1.12
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
brace-expansion@2.0.1
2.0.2
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.