StackRadar

CVE-2025-67221

High

Advisory

Published 22 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
65
of 17,781 indexed, latest versions
Container images
77
deployed by those charts
Fix available
1 of 1
affected package

orjson does not limit recursion for deeply nested JSON documents

Carried by container images the latest versions of 65 of 17,781 indexed charts deploy, on 77 images.

Affected packageAffected versionsFixed inImages
orjsonpypi2.6.1, 2.6.8, 3.3.1, 3.5.2+18 more3.11.677
OSV records
GHSA-hx9q-6w63-j58v
Also known as
PYSEC-2026-107

Charts affected

65 by stars
ChartLatestAffected imagesRadar Score
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
orjson@3.3.1
3.11.6

Open the chart page →

4,086
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
orjson@3.3.1
3.11.6

Open the chart page →

4,918
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
orjson@3.9.9
3.11.6

Open the chart page →

6,041
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
orjson@3.3.1
3.11.6

Open the chart page →

5,173
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
orjson@3.5.2
3.11.6
stackstorm/st2api:3.86f56d239d280
orjson@3.5.2
3.11.6
stackstorm/st2auth:3.833ecfda16608
orjson@3.5.2
3.11.6
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
orjson@3.5.2
3.11.6
stackstorm/st2notifier:3.8f190a6212195
orjson@3.5.2
3.11.6
stackstorm/st2rulesengine:3.8259503496ff9
orjson@3.5.2
3.11.6
stackstorm/st2scheduler:3.8b1de2055c362
orjson@3.5.2
3.11.6
stackstorm/st2sensorcontainer:3.8b1a338f64773
orjson@3.5.2
3.11.6
stackstorm/st2stream:3.81c8904a3bf67
orjson@3.5.2
3.11.6
stackstorm/st2timersengine:3.81bf35bfaf00c
orjson@3.5.2
3.11.6
stackstorm/st2workflowengine:3.819fdfffdbba8
orjson@3.5.2
3.11.6

Open the chart page →

96,419
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
orjson@3.10.3
3.11.6

Open the chart page →

17,404
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
orjson@3.11.5
3.11.6

Open the chart page →

4,634
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
orjson@3.11.5
3.11.6

Open the chart page →

3,804
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
orjson@3.8.10
3.11.6

Open the chart page →

17,877
datacube-explorerdatacube-charts0.5.321 of 1See more

datacube-explorer datacube-charts 0.5.32

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
opendatacube/explorer:latest120457ffcd69
orjson@3.11.4
3.11.6

Open the chart page →

4,854
datadogdatadog-test2.4.231 of 2See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datadog/agent:7.22.08f20e56b5311
orjson@2.6.1
3.11.6

Open the chart page →

4,568
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
orjson@3.11.4
3.11.6

Open the chart page →

3,671
haproxy-redis-sentinelhaproxy-redis-sentinelVerified publisher0.1.31 of 2See more

haproxy-redis-sentinel haproxy-redis-sentinel 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/parmincloud/haproxy-redis-sentinel:1.0.040a00a6456ae
orjson@3.10.16
3.11.6

Open the chart page →

4,277
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
orjson@3.10.16
3.11.6

Open the chart page →

6,374
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
orjson@3.10.6
3.11.6

Open the chart page →

16,514
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
orjson@3.11.3
3.11.6

Open the chart page →

15,712
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
orjson@3.10.5
3.11.6

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
orjson@3.10.12
3.11.6

Open the chart page →

4,292
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
orjson@3.11.5
3.11.6

Open the chart page →

7,201
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
orjson@3.11.3
3.11.6

Open the chart page →

3,929
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
orjson@3.10.12
3.11.6

Open the chart page →

1,696
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.23.73b3a670af168
orjson@3.10.15
3.11.6

Open the chart page →

12,473
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
orjson@3.3.1
3.11.6

Open the chart page →

5,521
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
orjson@3.10.3
3.11.6

Open the chart page →

10,145
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
orjson@3.10.6
3.11.6

Open the chart page →

4,042
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
orjson@3.10.15
3.11.6
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
orjson@3.11.5
3.11.6

Open the chart page →

58,897
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
orjson@3.9.9
3.11.6

Open the chart page →

6,179
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
orjson@3.10.15
3.11.6

Open the chart page →

19,224
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
orjson@3.8.3
3.11.6

Open the chart page →

4,085
datadog-apmfairwinds-incubator2.0.01 of 1See more

datadog-apm fairwinds-incubator 2.0.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
orjson@3.11.3
3.11.6

Open the chart page →

2,785
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
orjson@3.11.4
3.11.6

Open the chart page →

8,923
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
orjson@3.10.6
3.11.6
clsen2024/gwangju_2-3:service-a-151b1d45961cd
orjson@3.10.6
3.11.6
clsen2024/gwangju_2-3:service-c-1efb1586c8299
orjson@3.10.6
3.11.6

Open the chart page →

6,491
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
orjson@3.10.12
3.11.6

Open the chart page →

4,647
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
orjson@3.11.4
3.11.6

Open the chart page →

2,736
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
orjson@3.10.13
3.11.6

Open the chart page →

5,062
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
orjson@3.11.5
3.11.6

Open the chart page →

4,568
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
orjson@3.9.7
3.11.6

Open the chart page →

6,447
pavkrzwiatrzyk0.0.31 of 1See more

pav krzwiatrzyk 0.0.3

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
witcherek7/pav:0.0.342a744f29ac0
orjson@3.8.3
3.11.6

Open the chart page →

1,132
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
orjson@3.10.16
3.11.6

Open the chart page →

8,405
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
orjson@2.6.8
3.11.6

Open the chart page →

3,052
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
orjson@3.8.0
3.11.6

Open the chart page →

43,341
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
orjson@3.8.7
3.11.6

Open the chart page →

5,456
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
orjson@3.10.3
3.11.6

Open the chart page →

18,922
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
orjson@3.11.3
3.11.6

Open the chart page →

4,749
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
orjson@3.10.7
3.11.6

Open the chart page →

5,451
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
orjson@3.10.15
3.11.6

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
orjson@3.10.15
3.11.6

Open the chart page →

4,718
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
orjson@3.10.0
3.11.6

Open the chart page →

5,565
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
orjson@3.10.3
3.11.6

Open the chart page →

2,416
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-67221.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
orjson@3.10.7
3.11.6

Open the chart page →

4,393

Container images carrying it

77 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
stackstorm/st2auth:3.833ecfda16608
orjson@3.5.2
3.11.6
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
orjson@3.5.2
3.11.6
1
stackstorm/st2notifier:3.8f190a6212195
orjson@3.5.2
3.11.6
1
stackstorm/st2rulesengine:3.8259503496ff9
orjson@3.5.2
3.11.6
1
stackstorm/st2scheduler:3.8b1de2055c362
orjson@3.5.2
3.11.6
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
orjson@3.5.2
3.11.6
1
stackstorm/st2stream:3.81c8904a3bf67
orjson@3.5.2
3.11.6
1
stackstorm/st2timersengine:3.81bf35bfaf00c
orjson@3.5.2
3.11.6
1
stackstorm/st2workflowengine:3.819fdfffdbba8
orjson@3.5.2
3.11.6
1
thelande/kasa_exporter:v0.2.3a1fdb8baa152
orjson@3.10.3
3.11.6
1
witcherek7/pav:0.0.342a744f29ac0
orjson@3.8.3
3.11.6
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
orjson@3.10.12
3.11.6
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
orjson@3.11.5
3.11.6
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
orjson@3.10.6
3.11.6
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
orjson@3.10.12
3.11.6
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
orjson@3.11.3
3.11.6
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
orjson@3.9.9
3.11.6
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
orjson@3.11.5
3.11.6
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
orjson@3.11.3
3.11.6
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
orjson@3.11.3
3.11.6
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
orjson@3.10.0
3.11.6
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
orjson@3.11.5
3.11.6
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
orjson@3.11.5
3.11.6
1
ghcr.io/parmincloud/haproxy-redis-sentinel:1.0.040a00a6456ae
orjson@3.10.16
3.11.6
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
orjson@3.11.3
3.11.6
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
orjson@3.10.3
3.11.6
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
orjson@3.11.4
3.11.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.