StackRadar

CVE-2026-101043

High

Advisory

Published 1 Sept 2026In the index since 28 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.002
12th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,939 indexed, latest versions
Container images
25
deployed by those charts
Fix available
1 of 1
affected package

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Carried by container images the latest versions of 22 of 17,939 indexed charts deploy, on 25 images.

Affected packageAffected versionsFixed inImages
pnpmnpm10.8.0, 10.12.1, 10.15.1, 10.17.0+14 more10.34.5, 11.11.025
OSV records
GHSA-vx52-2968-3vc6

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
pnpm@10.22.0
10.34.5

Open the chart page →

81,455
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
pnpm@11.9.0
11.11.0

Open the chart page →

71,190
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
pnpm@11.2.2
11.11.0

Open the chart page →

6,076
umamichristianhuthVerified publisher7.14.01 of 2See more

umami christianhuth 7.14.0

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
pnpm@10.24.0
10.34.5

Open the chart page →

2,400
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
pnpm@11.5.3
11.11.0

Open the chart page →

1,355
litlyxlitlyx0.2.02 of 5See more

litlyx litlyx 0.2.0

2 of the 5 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
litlyx/litlyx-consumer:latest02225e77d316
pnpm@10.23.0
10.34.5
litlyx/litlyx-producer:latest10407f36613f
pnpm@10.23.0
10.34.5

Open the chart page →

8,270
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
pnpm@10.15.1
10.34.5

Open the chart page →

7,722
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
pnpm@10.33.0
10.34.5

Open the chart page →

5,898
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
pnpm@10.17.0
10.34.5
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
pnpm@10.17.0
10.34.5

Open the chart page →

19,137
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pnpm@10.8.0
10.34.5

Open the chart page →

15,508
fluxer-helmfluxer-helm0.3.01 of 18See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
pnpm@10.29.3
10.34.5

Open the chart page →

29,230
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
pnpm@10.19.0
10.34.5

Open the chart page →

5,365
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
pnpm@10.33.0
10.34.5

Open the chart page →

3,710
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
pnpm@10.33.0
10.34.5

Open the chart page →

3,357
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
pnpm@11.1.2
11.11.0

Open the chart page →

2,922
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
pnpm@10.33.0
10.34.5

Open the chart page →

2,423
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
pnpm@10.34.4
10.34.5
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
pnpm@10.34.4
10.34.5

Open the chart page →

3,008
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
pnpm@10.12.1
10.34.5

Open the chart page →

25,120
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
pnpm@10.25.0
10.34.5

Open the chart page →

3,732
nostreamnostream0.1.01 of 1See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/cameri/nostream:mainc134ac2fa289
pnpm@10.33.0
10.34.5

Open the chart page →

505
firecrawlobeoneVerified publisher3.0.141 of 5See more

firecrawl obeone 3.0.14

1 of the 5 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
ghcr.io/firecrawl/firecrawl:2.11.408966ef7f9a385
pnpm@11.4.0
11.11.0

Open the chart page →

10,619
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-101043.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
pnpm@11.5.1
11.11.0

Open the chart page →

4,348

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
aaronshaf/dynamodb-admin:latestac41724cd997
pnpm@11.5.3
11.11.0
1
archivebox/archivebox:0.9.708c21bb233130
pnpm@10.19.0
10.34.5
1
chocobozzz/peertube:v8.1.5052712130691
pnpm@10.15.1
10.34.5
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
pnpm@11.9.0
11.11.0
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
pnpm@10.22.0
10.34.5
1
library/ghost:6.37.01ef2e532ca4d
pnpm@10.33.0
10.34.5
1
library/ghost:6.41.129773d6be407
pnpm@10.33.0
10.34.5
1
library/ghost:6.39.0-alpine77196da4b0df
pnpm@11.1.2
11.11.0
1
litlyx/litlyx-consumer:latest02225e77d316
pnpm@10.23.0
10.34.5
1
litlyx/litlyx-producer:latest10407f36613f
pnpm@10.23.0
10.34.5
1
rocketadmin/rocketadmin:1.17.710955ef540b9
pnpm@10.33.0
10.34.5
1
tensorzero/ui:2026.6.0f2563d54724e
pnpm@11.5.1
11.11.0
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
pnpm@10.12.1
10.34.5
1
ghcr.io/cameri/nostream:mainc134ac2fa289
pnpm@10.33.0
10.34.5
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pnpm@10.8.0
10.34.5
1
ghcr.io/firecrawl/firecrawl:2.11.408966ef7f9a385
pnpm@11.4.0
11.11.0
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
pnpm@10.29.3
10.34.5
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
pnpm@10.17.0
10.34.5
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
pnpm@10.17.0
10.34.5
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
pnpm@10.34.4
10.34.5
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
pnpm@10.34.4
10.34.5
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
pnpm@11.2.2
11.11.0
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
pnpm@10.25.0
10.34.5
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
pnpm@10.24.0
10.34.5
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
pnpm@10.33.0
10.34.5
1

syft 1.42.1 · advisories as of 29 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.