StackRadar

CVE-2025-68458

Low

Advisory

Published 5 Feb 2026In the index since 5 Sept 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.002
11th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
66
of 17,781 indexed, latest versions
Container images
68
deployed by those charts
Fix available
1 of 2
affected packages

webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior

Carried by container images the latest versions of 66 of 17,781 indexed charts deploy, on 68 images.

Affected packageAffected versionsFixed inImages
webpacknpm5.70.0, 5.72.0, 5.73.0, 5.74.0+24 more5.104.168
node-webpackdeb5.76.1+dfsg1+~cs17.16.16-1no fix listed1
OSV records
GHSA-8fgc-7cc6-rx7xUBUNTU-CVE-2025-68458

Charts affected

66 by stars
ChartLatestAffected imagesRadar Score
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
webpack@5.78.0
5.104.1

Open the chart page →

17,929
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
webpack@5.88.2
5.104.1

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
webpack@5.88.2
5.104.1

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
webpack@5.88.2
5.104.1

Open the chart page →

15,187
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
webpack@5.89.0
5.104.1

Open the chart page →

6,282
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
webpack@5.99.9
5.104.1

Open the chart page →

5,338
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
webpack@5.89.0
5.104.1

Open the chart page →

7,413
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
webpack@5.92.1
5.104.1

Open the chart page →

19,560
semaphoreschoenwald0.1.31 of 1See more

semaphore schoenwald 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
0hlov3/semaphore:v1.0.050f874ec096b
webpack@5.75.0
5.104.1

Open the chart page →

1,796
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
webpack@5.94.0
5.104.1

Open the chart page →

5,497
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
webpack@5.82.0
5.104.1

Open the chart page →

7,574
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
webpack@5.99.6
5.104.1

Open the chart page →

1,313
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
webpack@5.82.1
5.104.1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
webpack@5.82.1
5.104.1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
webpack@5.82.1
5.104.1

Open the chart page →

6,994
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
webpack@5.89.0
5.104.1

Open the chart page →

17,323
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
webpack@5.97.1
5.104.1

Open the chart page →

5,984
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2025-68458.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
webpack@5.88.2
5.104.1

Open the chart page →

16,083

Container images carrying it

68 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
webpack@5.88.2
5.104.1
1
winfred008/amazon:910a68de5b398
webpack@5.80.0
5.104.1
1
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
webpack@5.88.1
5.104.1
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
webpack@5.98.0
5.104.1
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
webpack@5.89.0
5.104.1
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
webpack@5.99.9
5.104.1
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
webpack@5.99.9
5.104.1
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
webpack@5.89.0
5.104.1
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
webpack@5.94.0
5.104.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
webpack@5.82.1
5.104.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
webpack@5.82.1
5.104.1
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
webpack@5.82.1
5.104.1
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
webpack@5.89.0
5.104.1
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
webpack@5.98.0
5.104.1
1
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
webpack@5.93.0
5.104.1
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
webpack@5.99.6
5.104.1
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
webpack@5.89.0
5.104.1
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
webpack@5.100.2
5.104.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.