StackRadar

CVE-2025-5891

Medium

Advisory

Published 9 Jun 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
27
of 17,781 indexed, latest versions
Container images
25
deployed by those charts
Fix available
1 of 1
affected package

pm2 Regular Expression Denial of Service vulnerability

Carried by container images the latest versions of 27 of 17,781 indexed charts deploy, on 25 images.

Affected packageAffected versionsFixed inImages
pm2npm2.9.1, 3.2.2, 4.4.0, 4.5.4+10 more7.0.025
OSV records
GHSA-x5gf-qvw8-r2rm

Charts affected

27 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
pm2@6.0.14
7.0.0

Open the chart page →

19,391
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
pm2@5.2.0
7.0.0

Open the chart page →

4,285
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
pm2@5.4.2
7.0.0

Open the chart page →

7,450
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
pm2@5.1.2
7.0.0

Open the chart page →

18,517
soketisoketi2.0.01 of 1See more

soketi soketi 2.0.0

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
quay.io/soketi/soketi:1.6-16-debian713223456cf1
pm2@5.3.0
7.0.0

Open the chart page →

1,636
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
pm2@6.0.14
7.0.0

Open the chart page →

7,473
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
pm2@5.3.0
7.0.0

Open the chart page →

3,925
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
pm2@4.5.4
7.0.0

Open the chart page →

2,519
growthbookgrowthbook5.0.11 of 2See more

growthbook growthbook 5.0.1

1 of the 2 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
growthbook/growthbook:5.0.1f53ead646b5f
pm2@6.0.14
7.0.0

Open the chart page →

709
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
pm2@5.4.0
7.0.0

Open the chart page →

20,403
youtubedl-materialyoutubedl-materialVerified publisher0.0.11 of 1See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:latest2f943d584711
pm2@5.3.0
7.0.0

Open the chart page →

9,783
ethereumcloudnativeapp1.0.01 of 3See more

ethereum cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
pm2@2.9.1
7.0.0

Open the chart page →

27,417
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
pm2@5.4.3
7.0.0

Open the chart page →

19,224
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
pm2@5.4.2
7.0.0

Open the chart page →

4,551
iotagent-ulfiware0.1.21 of 1See more

iotagent-ul fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
fiware/iotagent-ul:1.14.0fe11f55a926d
pm2@3.2.2
7.0.0

Open the chart page →

3,337
shinobigeek-cookbookVerified publisher1.2.21 of 1See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
shinobisystems/shinobi:dev3ca746937856
pm2@5.1.0
7.0.0

Open the chart page →

4,591
indexer-chartindexer-application0.1.01 of 1See more

indexer-chart indexer-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
ibarreche/cloud-indexer-ci:latestb7a08274e69f
pm2@5.2.0
7.0.0

Open the chart page →

3,289
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
pm2@5.1.0
7.0.0

Open the chart page →

4,667
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
pm2@5.3.0
7.0.0

Open the chart page →

9,783
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
pm2@6.0.14
7.0.0

Open the chart page →

8,405
sentence-collectormozilla0.1.21 of 2See more

sentence-collector mozilla 0.1.2

1 of the 2 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
mozilla/sentencecollector:2.0.91da6ff5c4895
pm2@4.4.0
7.0.0

Open the chart page →

6,684
readability-js-serverreadability-js-server0.1.01 of 1See more

readability-js-server readability-js-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
phpdockerio/readability-js-server:1.8.0ea8354b42600
pm2@6.0.14
7.0.0

Open the chart page →

1,858
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
pm2@5.3.1
7.0.0

Open the chart page →

7,413
sorry-cypresssoftonic1.20.01 of 4See more

sorry-cypress softonic 1.20.0

1 of the 4 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
pm2@5.2.0
7.0.0

Open the chart page →

4,285
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
pm2@5.2.0
7.0.0

Open the chart page →

4,017
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
pm2@5.4.3
7.0.0

Open the chart page →

5,535
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-5891.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
pm2@6.0.8
7.0.0

Open the chart page →

5,984

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
agoldis/sorry-cypress-director:2.5.1110228ecd353b
pm2@5.2.0
7.0.0
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
pm2@5.3.0
7.0.0
2
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
pm2@6.0.14
7.0.0
1
codetogether/codetogether:latest4348c8a38752
pm2@5.4.2
7.0.0
1
directus/directus:12.0.29c8470ea465c
pm2@6.0.14
7.0.0
1
directus/directus:11.1.0e3c8bb975350
pm2@5.4.2
7.0.0
1
enketo/enketo-express:3.0.4dcad9c2273f6
pm2@5.1.2
7.0.0
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
pm2@2.9.1
7.0.0
1
fiware/iotagent-ul:1.14.0fe11f55a926d
pm2@3.2.2
7.0.0
1
growthbook/growthbook:5.0.1f53ead646b5f
pm2@6.0.14
7.0.0
1
ibarreche/cloud-indexer-ci:latestb7a08274e69f
pm2@5.2.0
7.0.0
1
joplin/server:latest3f7b852959aa
pm2@5.4.3
7.0.0
1
joplin/server:3.0-beta52af57880c0e
pm2@5.3.1
7.0.0
1
joplin/server:2.14.2-betab87564ef34e9
pm2@5.3.0
7.0.0
1
langgenius/dify-web:0.6.11a2a294743634
pm2@5.4.0
7.0.0
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
pm2@6.0.14
7.0.0
1
langgenius/dify-web:1.0.0d64914ff0d6d
pm2@5.4.3
7.0.0
1
mozilla/sentencecollector:2.0.91da6ff5c4895
pm2@4.4.0
7.0.0
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
pm2@6.0.14
7.0.0
1
polonel/trudesk:1.2.60cf6513f6fe3
pm2@5.2.0
7.0.0
1
shinobisystems/shinobi:dev3ca746937856
pm2@5.1.0
7.0.0
1
shinobisystems/shinobi:latestc2f5ce2e1067
pm2@5.1.0
7.0.0
1
sigp/siren:v3.0.42c219b04758e
pm2@6.0.8
7.0.0
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
pm2@4.5.4
7.0.0
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
pm2@5.3.0
7.0.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.