CVE-2025-68458
LowAdvisory
Published 5 Feb 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.7
- base score, highest
- EPSS
- 0.002
- 11th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 66
- of 17,781 indexed, latest versions
- Container images
- 68
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Carried by container images the latest versions of 66 of 17,781 indexed charts deploy, on 68 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| webpacknpm | 5.70.0, 5.72.0, 5.73.0, 5.74.0+24 more | 5.104.1 | 68 |
| node-webpackdeb | 5.76.1+dfsg1+~cs17.16.16-1 | no fix listed | 1 |
- OSV records
- GHSA-8fgc-7cc6-rx7xUBUNTU-CVE-2025-68458
Charts affected
66 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| myweatherhelmmyweather | 1.3.11 | 1 of 7See more | 17,929 |
| notes-admin-front-helm-chartnotesprojectchart | 0.1.0 | 1 of 1See more | 15,132 |
| notes-project-fromt-helm-chartnotesprojectchart | 0.1.0 | 1 of 1See more | 15,206 |
| registration-ms-front-helm-chartnotesprojectchart | 0.1.0 | 1 of 1See more | 15,187 |
| relfinder-reformedrelfinderreformed | 2.0.0 | 1 of 2See more | 6,282 |
| karakeeprtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 3See more | 5,338 |
| joplinrubxkubeVerified publisher | 1.3.1 | 1 of 2See more | 7,413 |
| safe-stacksafe-global | 0.1.0 | 1 of 9See more | 19,560 |
| semaphoreschoenwald | 0.1.3 | 1 of 1See more | 1,796 |
| secret-managersecret-managerVerified publisher | 1.0.0 | 1 of 4See more | 5,497 |
| sneakerssneakers | 1.0.0 | 1 of 4See more | 7,574 |
| retail-store-sample-checkout-chartstacksimplifyVerified publisher | 1.0.0 | 1 of 1See more | 1,313 |
| saleor-appstrieb-work | 0.6.0 | 3 of 5See more | 6,994 |
| tfy-distributortruefoundryVerified publisher | 0.0.1 | 1 of 4See more | 17,323 |
| sirenwateim | 1.0.2 | 1 of 1See more | 5,984 |
| workadventureworkadventure | 1.1.0 | 1 of 9See more | 16,083 |
Container images carrying it
68 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| rcdelacruz/ | 38007f358355 | webpack | 5.104.1 | 3 |
| ghcr.io/ | db4362ec0d3b | webpack | 5.104.1 | 2 |
| 0hlov3/ | 50f874ec096b | webpack | 5.104.1 | 1 |
| apimap/ | 406d3858e20c | webpack | 5.104.1 | 1 |
| apimap/ | 041a4790c65c | webpack | 5.104.1 | 1 |
| assistiot/ | f11d82defc70 | webpack | 5.104.1 | 1 |
| bicarus/ | dab88659ae3b | webpack | 5.104.1 | 1 |
| ccjacobs14/ | 9a9b14a6f09e | webpack | 5.104.1 | 1 |
| codetogether/ | 4348c8a38752 | webpack | 5.104.1 | 1 |
| coldatom/ | eae9e82da080 | webpack | 5.104.1 | 1 |
| coldatom/ | 7c2fbbb41bcf | webpack | 5.104.1 | 1 |
| cortezaproject/ | 4ea78dfe5364 | webpack | 5.104.1 | 1 |
| countly/ | f4cc7447c4f5 | webpack | 5.104.1 | 1 |
| countly/ | e3c238248f99 | webpack | 5.104.1 | 1 |
| countly/ | 2acbc11499b6 | webpack | 5.104.1 | 1 |
| dessalines/ | ee4c620d8e93 | webpack | 5.104.1 | 1 |
| documenso/ | 7f16a9449f18 | webpack | 5.104.1 | 1 |
| dserio83/ | b4e1ec6664d3 | webpack | 5.104.1 | 1 |
| flanksource/ | 764c84e550db | webpack | 5.104.1 | 1 |
| hecrom/ | 5454b54d5b28 | webpack | 5.104.1 | 1 |
| helga09/ | 7999bc8b77c0 | webpack | 5.104.1 | 1 |
| heywood8/ | 0bc9ab313d37 | webpack | 5.104.1 | 1 |
| instill/ | 4cd70e2df5c6 | webpack | 5.104.1 | 1 |
| joplin/ | 52af57880c0e | webpack | 5.104.1 | 1 |
| joplin/ | b87564ef34e9 | webpack | 5.104.1 | 1 |
| jupyterhub/ | 3974ba945e65 | node-webpack webpack | no fix listed 5.104.1 | 1 |
| keyoxide/ | 96f27a71269d | webpack | 5.104.1 | 1 |
| kobotoolbox/ | bcacc01bccd4 | webpack | 5.104.1 | 1 |
| kyleslugg/ | ba8c36dfdfbd | webpack | 5.104.1 | 1 |
| langgenius/ | c306ac577912 | webpack | 5.104.1 | 1 |
| langgenius/ | d64914ff0d6d | webpack | 5.104.1 | 1 |
| leonardomulticloud/ | e42a341e0299 | webpack | 5.104.1 | 1 |
| loftsh/ | 25deb9bd2683 | webpack | 5.104.1 | 1 |
| mintproject/ | 222e3b941a36 | webpack | 5.104.1 | 1 |
| misskey/ | e08b7c478093 | webpack | 5.104.1 | 1 |
| mitchxxx/ | 4e72480ec63a | webpack | 5.104.1 | 1 |
| nightscout/ | ad29ca7a4de6 | webpack | 5.104.1 | 1 |
| nightscout/ | f604dc4c03ca | webpack | 5.104.1 | 1 |
| ooghenekaro/ | 03394ba1d6d8 | webpack | 5.104.1 | 1 |
| safeglobal/ | 12ccfd93fcaf | webpack | 5.104.1 | 1 |
| sigp/ | 2c219b04758e | webpack | 5.104.1 | 1 |
| supabase/ | 26d8070c55e9 | webpack | 5.104.1 | 1 |
| sysnet4admin/ | e74b43c7f492 | webpack | 5.104.1 | 1 |
| sysnet4admin/ | 5802bfcd7fed | webpack | 5.104.1 | 1 |
| thecodingmachine/ | 5bdab56da2fa | webpack | 5.104.1 | 1 |
| treskon/ | e7970783bc8d | webpack | 5.104.1 | 1 |
| unitycatalog/ | 3a688197b218 | webpack | 5.104.1 | 1 |
| visualregressiontracker/ | 941aeb8c8bf9 | webpack | 5.104.1 | 1 |
| vlebediantsev/ | 007c6670ff48 | webpack | 5.104.1 | 1 |
| vlebediantsev/ | 945675fd2636 | webpack | 5.104.1 | 1 |