CVE-2026-102941

High

Advisory

Published 16 Oct 2026In the index since 17 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 28; of 18,143 indexed, latest versions
Container images: 35; deployed by those charts
Fix available: 1 of 1; affected package

gomarkdown/markdown IsSafeURL panics on short URLs

Carried by container images the latest versions of 28 of 18,143 indexed charts deploy, on 35 images.

Affected package	Affected versions	Fixed in	Images
github.com/gomarkdown/markdowngolang	v0.0.0-20191123064959-2c17d62f5098, v0.0.0-20200609195525-3f9352745725, v0.0.0-20230716120725-531d2d74bc12, v0.0.0-20230922112808-5421fefb8386+8 more	0.0.0-20260724235538-61af6e1e6971	35

OSV records: GHSA-cv23-7vc5-jfh7

Charts affected

28 by stars

Chart

Latest

Affected images

Radar Score

codercoder-v2

2.38.0

1 of 1 See more

coder coder-v2 2.38.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/coder/coder :v2.38.0	38a4cfc548b0	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

401

local-ailocalai

3.4.2

1 of 1 See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
quay.io/go-skynet/local-ai :latest	f1bc435659b9	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

4,217

coreinstill-ai

0.1.75

1 of 15 See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.28	cfde8170c92f	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

14,532

agentareaagentarea

0.0.27

1 of 17 See more

agentarea agentarea 0.0.27

1 of the 17 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/auto-setup :1.29.1	5b3502a3b685	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

16,960

airbyteairbyte-v2

2.4.0

1 of 10 See more

airbyte airbyte-v2 2.4.0

1 of the 10 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/auto-setup :1.27.2	b44cbfeb43db	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

15,702

platform-apiappscode

2026.10.15

1 of 3 See more

platform-api appscode 2026.10.15

1 of the 3 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	github.com/gomarkdown/markdown@v0.0.0-20250810172220-2e2c11897d1a	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

44,391

temporalcastai

0.54.2

3 of 14 See more

temporal castai 0.54.2

3 of the 14 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.26.2	37e2e33dbd7b	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971
temporalio/server :1.26.2	1e2626efcbc1	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971
temporalio/ui :2.33.0	5c586a3c8ec5	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

23,403

coder-ai-gatewaycoder-v2

2.38.0

1 of 1 See more

coder-ai-gateway coder-v2 2.38.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/coder/coder :v2.38.0	38a4cfc548b0	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

401

coder-provisionercoder-v2

2.38.0

1 of 1 See more

coder-provisioner coder-v2 2.38.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/coder/coder :v2.38.0	38a4cfc548b0	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

401

csghubcsghub

2.6.0

1 of 35 See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.32.0	a9f84fb9a374	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

68,160

fairwinds-insightsfairwinds-stable

10.7.2

2 of 13 See more

fairwinds-insights fairwinds-stable 10.7.2

2 of the 13 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.32.0	a9f84fb9a374	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971
temporalio/ui :2.54.1	ff0943fe532b	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

3,973

grapple-installergrapple-installer

0.3.23

1 of 1 See more

grapple-installer grapple-installer 0.3.23

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
grpl/grapple-cli :0.2.127	c00aafee6629	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

90,439

temporalgroundcover

1.13.101

2 of 2 See more

temporal groundcover 1.13.101

2 of the 2 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/temporalio/admin-tools :1.29.7-20260929-1	f21c0eb520a9	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971
public.ecr.aws/groundcovercom/temporalio/server :1.29.6-mini-20260702-1	70f191d0a80e	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

2,594

temporalhelmforge

1.0.0

2 of 4 See more

temporal helmforge 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.32.1	9ef0dc5b063b	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971
temporalio/ui :2.56.0	66d55d383bfb	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

2,684

svacerhelm-svacer

0.6.0

1 of 1 See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ispras/svacer :11-2-0	42aa9fa9f189	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

7,310

kubefaashfoxy-helm-charts

0.1.6

2 of 4 See more

kubefaas hfoxy-helm-charts 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
hfoxy4/kubefaas-builder :main-2afc757	0bfb65aaad93	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971
hfoxy4/kubefaas-controller :main-2afc757	0761fe08f14c	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

8,190

paperlesshp

0.1.2

1 of 5 See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.34	67097317623a	github.com/gomarkdown/markdown@v0.0.0-20260417124207-7d523f7318df	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

36,128

kbot-self-hostedkbot-self-hosted

0.1.8

1 of 7 See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.30	206a6c708fc6	github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

39,489

picoclawloafoe

0.1.2

1 of 2 See more

picoclaw loafoe 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

877

twtxtnicholaswilde

1.0.0

1 of 1 See more

twtxt nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/nicholaswilde/twtxt :version-0.1.1	58736a73ca10	github.com/gomarkdown/markdown@v0.0.0-20200609195525-3f9352745725	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

3,580

rotational-apirotational

1.3.1

1 of 1 See more

rotational-api rotational 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
rotationalio/rotational-api :1.3.0	f1a2d05d8fff	github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

2,209

agentssynapse

0.1.30

2 of 9 See more

agents synapse 0.1.30

2 of the 9 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/agents :6e3887fc2a05aff0d159453cedbfbe5024b910bf	81a9ebc899a4	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971
ghcr.io/synapsecns/sanguine/scribe :6e3887fc2a05aff0d159453cedbfbe5024b910bf	5e0a3dfa9f96	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

10,376

explorersynapse

0.2.16

1 of 6 See more

explorer synapse 0.2.16

1 of the 6 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/explorer :latest	00131e3d1eaf	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

11,113

scribesynapse

0.2.16

1 of 7 See more

scribe synapse 0.2.16

1 of the 7 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/scribe :latest	81edba952403	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

3,939

sinnersynapse

0.1.0

1 of 6 See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/sinner :latest	3e98a98f6074	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

2,715

wexa-studiowexa-studio

1.2.0

3 of 15 See more

wexa-studio wexa-studio 1.2.0

3 of the 15 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971
temporalio/server :1.29.1	c1e3326b2ce1	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971
temporalio/ui :2.44.0	0b36e00aad30	github.com/gomarkdown/markdown@v0.0.0-20240729212818-a2a9c4f76ef5	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

17,282

oauth2xd

1.0.0

1 of 1 See more

oauth2 xd 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
lishimeng/hufu :v1.2.1	3d5752dac834	github.com/gomarkdown/markdown@v0.0.0-20230716120725-531d2d74bc12	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

2,744

owlxd

0.5.1

2 of 2 See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-102941.

Container image	Digest	Package	Fixed in
lishimeng/owl-console :v0.11.2	c79a67657baf	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971
lishimeng/owl-messager :v0.11.2	3d00485e64dc	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971

Open the chart page →

5,580

Container images carrying it

35 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/coder/coder :v2.38.0	38a4cfc548b0	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	3
temporalio/admin-tools :1.32.0	a9f84fb9a374	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	2
gotenberg/gotenberg :8.30	206a6c708fc6	github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab	0.0.0-20260724235538-61af6e1e6971	1
gotenberg/gotenberg :8.34	67097317623a	github.com/gomarkdown/markdown@v0.0.0-20260417124207-7d523f7318df	0.0.0-20260724235538-61af6e1e6971	1
grpl/grapple-cli :0.2.127	c00aafee6629	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971	1
hfoxy4/kubefaas-builder :main-2afc757	0bfb65aaad93	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971	1
hfoxy4/kubefaas-controller :main-2afc757	0761fe08f14c	github.com/gomarkdown/markdown@v0.0.0-20231222211730-1d6d20845b47	0.0.0-20260724235538-61af6e1e6971	1
ispras/svacer :11-2-0	42aa9fa9f189	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971	1
lishimeng/hufu :v1.2.1	3d5752dac834	github.com/gomarkdown/markdown@v0.0.0-20230716120725-531d2d74bc12	0.0.0-20260724235538-61af6e1e6971	1
lishimeng/owl-console :v0.11.2	c79a67657baf	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971	1
lishimeng/owl-messager :v0.11.2	3d00485e64dc	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971	1
rotationalio/rotational-api :1.3.0	f1a2d05d8fff	github.com/gomarkdown/markdown@v0.0.0-20260217112301-37c66b85d6ab	0.0.0-20260724235538-61af6e1e6971	1
temporalio/admin-tools :1.26.2	37e2e33dbd7b	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971	1
temporalio/admin-tools :1.32.1	9ef0dc5b063b	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971	1
temporalio/admin-tools :1.28	cfde8170c92f	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971	1
temporalio/auto-setup :1.29.1	5b3502a3b685	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971	1
temporalio/auto-setup :1.27.2	b44cbfeb43db	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971	1
temporalio/server :1.26.2	1e2626efcbc1	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971	1
temporalio/server :1.29.1	c1e3326b2ce1	github.com/gomarkdown/markdown@v0.0.0-20250311123330-531bef5e742b	0.0.0-20260724235538-61af6e1e6971	1
temporalio/ui :2.44.0	0b36e00aad30	github.com/gomarkdown/markdown@v0.0.0-20240729212818-a2a9c4f76ef5	0.0.0-20260724235538-61af6e1e6971	1
temporalio/ui :2.33.0	5c586a3c8ec5	github.com/gomarkdown/markdown@v0.0.0-20241105142532-d03b89096d81	0.0.0-20260724235538-61af6e1e6971	1
temporalio/ui :2.56.0	66d55d383bfb	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
temporalio/ui :2.54.1	ff0943fe532b	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	github.com/gomarkdown/markdown@v0.0.0-20250810172220-2e2c11897d1a	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/nicholaswilde/twtxt :version-0.1.1	58736a73ca10	github.com/gomarkdown/markdown@v0.0.0-20200609195525-3f9352745725	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/synapsecns/sanguine/agents :6e3887fc2a05aff0d159453cedbfbe5024b910bf	81a9ebc899a4	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/synapsecns/sanguine/explorer :latest	00131e3d1eaf	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/synapsecns/sanguine/scribe :6e3887fc2a05aff0d159453cedbfbe5024b910bf	5e0a3dfa9f96	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/synapsecns/sanguine/scribe :latest	81edba952403	github.com/gomarkdown/markdown@v0.0.0-20230922112808-5421fefb8386	0.0.0-20260724235538-61af6e1e6971	1
ghcr.io/synapsecns/sanguine/sinner :latest	3e98a98f6074	github.com/gomarkdown/markdown@v0.0.0-20191123064959-2c17d62f5098	0.0.0-20260724235538-61af6e1e6971	1
public.ecr.aws/groundcovercom/temporalio/admin-tools :1.29.7-20260929-1	f21c0eb520a9	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
public.ecr.aws/groundcovercom/temporalio/server :1.29.6-mini-20260702-1	70f191d0a80e	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1
quay.io/go-skynet/local-ai :latest	f1bc435659b9	github.com/gomarkdown/markdown@v0.0.0-20260411013819-759bbc3e3207	0.0.0-20260724235538-61af6e1e6971	1