StackRadar

CVE-2025-66400

Medium

Advisory

Published 2 Dec 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
8
of 17,781 indexed, latest versions
Container images
9
deployed by those charts
Fix available
1 of 1
affected package

mdast-util-to-hast has unsanitized class attribute

Carried by container images the latest versions of 8 of 17,781 indexed charts deploy, on 9 images.

Affected packageAffected versionsFixed inImages
mdast-util-to-hastnpm13.0.2, 13.2.013.2.19
OSV records
GHSA-4fh9-h7wg-q85m

Charts affected

8 by stars
ChartLatestAffected imagesRadar Score
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

2,654
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
mdast-util-to-hast@13.0.2
13.2.1

Open the chart page →

28,839
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

10,090
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
mdast-util-to-hast@13.2.0
13.2.1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

18,293
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

2,529
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

2,950
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

666
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2025-66400.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
mdast-util-to-hast@13.2.0
13.2.1

Open the chart page →

7,084

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
lobehub/lobe-chat:1.96.9da0c21fefcd3
mdast-util-to-hast@13.2.0
13.2.1
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
mdast-util-to-hast@13.2.0
13.2.1
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
mdast-util-to-hast@13.0.2
13.2.1
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
mdast-util-to-hast@13.2.0
13.2.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.