StackRadar

CVE-2026-105829

Medium

Advisory

Published 30 Sept 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
47
of 18,137 indexed, latest versions
Container images
45
deployed by those charts
Fix available
1 of 1
affected package

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Carried by container images the latest versions of 47 of 18,137 indexed charts deploy, on 45 images.

Affected packageAffected versionsFixed inImages
league/commonmarkcomposer1.5.8, 1.6.4, 1.6.6, 1.6.7+14 more2.10.245
OSV records
GHSA-97jj-33gv-5xf9

Charts affected

47 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
league/commonmark@2.3.4
2.10.2

Open the chart page →

87,938
monicamonicaOfficialVerified publisher1.0.151 of 1See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/monicahq/monica-next:main8a02508cbdcf
league/commonmark@2.7.1
2.10.2

Open the chart page →

3,369
bookstackgabe565Verified publisher0.20.01 of 1See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/commonmark@2.6.1
2.10.2

Open the chart page →

3,302
invoiceninjainvoiceninjaVerified publisher0.10.21 of 5See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
invoiceninja/invoiceninja:5.6.241437916dee01
league/commonmark@2.4.0
2.10.2

Open the chart page →

2,785
bookstackbookstack-mgVerified publisher0.3.11 of 2See more

bookstack bookstack-mg 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
linuxserver/bookstack:26.05.202605282ebf97852661
league/commonmark@2.8.2
2.10.2

Open the chart page →

2,284
laravelrenoki-co1.0.01 of 2See more

laravel renoki-co 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
league/commonmark@1.5.8
2.10.2

Open the chart page →

7,737
repmanszpadel-chartsVerified publisher3.52.171 of 3See more

repman szpadel-charts 3.52.17

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/commonmark@1.6.6
2.10.2

Open the chart page →

7,726
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/commonmark@2.8.0
2.10.2

Open the chart page →

4,976
firefly-iiigeek-cookbookVerified publisher0.3.01 of 1See more

firefly-iii geek-cookbook 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.6.142f4283bd0cf7
league/commonmark@2.2.1
2.10.2

Open the chart page →

3,027
monicageek-cookbookVerified publisher8.2.01 of 1See more

monica geek-cookbook 8.2.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
library/monica:3.7.0-apacheceb1ba4196ab
league/commonmark@2.2.1
2.10.2

Open the chart page →

2,934
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
leantime/leantime:3.3.3ad4bfb0699d3
league/commonmark@2.5.3
2.10.2

Open the chart page →

7,723
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
league/commonmark@2.5.3
2.10.2

Open the chart page →

11,565
glpikitsune-itopsVerified publisher1.0.71 of 3See more

glpi kitsune-itops 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
glpi/glpi:latest8888c5d8aa46
league/commonmark@2.10.0
2.10.2

Open the chart page →

5,016
librenmsmidokura-communityVerified publisher0.3.21 of 6See more

librenms midokura-community 0.3.2

1 of the 6 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
librenms/librenms:22.4.14f1f3d667cc7
league/commonmark@1.6.7
2.10.2

Open the chart page →

10,074
snipe-itnicholaswildeVerified publisher1.0.51 of 1See more

snipe-it nicholaswilde 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/snipe-it:version-v5.1.8ac091e4c33bd
league/commonmark@1.6.4
2.10.2

Open the chart page →

1,044
laravel-octanerenoki-co1.0.01 of 1See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
league/commonmark@1.5.8
2.10.2

Open the chart page →

3,737
repmanrepman-helmchartVerified publisher1.0.121 of 3See more

repman repman-helmchart 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/commonmark@1.6.6
2.10.2

Open the chart page →

4,369
linkstackadnoctemVerified publisher0.4.01 of 1See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latest1c8b05399ee4
league/commonmark@2.8.0
2.10.2

Open the chart page →

2,530
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
n22107670/sample-app:0.4.08f3072db7aeb
league/commonmark@1.6.7
2.10.2

Open the chart page →

2,932
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/commonmark@2.8.2
2.10.2

Open the chart page →

13,944
webtreesdjjudas21Verified publisher3.0.01 of 1See more

webtrees djjudas21 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/commonmark@2.8.2
2.10.2

Open the chart page →

7,608
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
league/commonmark@2.4.2
2.10.2

Open the chart page →

1,753
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/commonmark@2.3.0
2.10.2

Open the chart page →

23,181
firefly-iiifirefly-iii1.10.11 of 1See more

firefly-iii firefly-iii 1.10.1

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2

Open the chart page →

5,934
firefly-iii-stackfirefly-iii0.10.22 of 4See more

firefly-iii-stack firefly-iii 0.10.2

2 of the 4 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2

Open the chart page →

12,056
importerfirefly-iii1.6.01 of 1See more

importer firefly-iii 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2

Open the chart page →

5,713
linkstackfmjstudios0.2.21 of 1See more

linkstack fmjstudios 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latestabd691b4293b
league/commonmark@2.4.0
2.10.2

Open the chart page →

2,768
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpine1104023d0636
league/commonmark@2.4.2
2.10.2

Open the chart page →

695
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
league/commonmark@2.3.3
2.10.2

Open the chart page →

5,743
bookstackgeek-cookbookVerified publisher5.2.01 of 1See more

bookstack geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
league/commonmark@1.6.6
2.10.2

Open the chart page →

1,342
lycheegeek-cookbookVerified publisher6.4.21 of 1See more

lychee geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
league/commonmark@1.5.8
2.10.2

Open the chart page →

639
webtreesgeek-cookbookVerified publisher2.2.01 of 1See more

webtrees geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
league/commonmark@1.6.6
2.10.2

Open the chart page →

5,200
castopodhelmforgeVerified publisher1.2.111 of 3See more

castopod helmforge 1.2.11

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
league/commonmark@2.8.0
2.10.2

Open the chart page →

11,025
heimdallhelmforgeVerified publisher1.1.141 of 1See more

heimdall helmforge 1.1.14

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.8.33c9e97c416c7
league/commonmark@2.8.2
2.10.2

Open the chart page →

240
fireflyhomeenterpriseinc2.7.02 of 2See more

firefly homeenterpriseinc 2.7.0

2 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.7.12c0300cfd3d76
league/commonmark@2.3.5
2.10.2
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/commonmark@2.3.5
2.10.2

Open the chart page →

3,897
firefly-iiikubernetes-homelab-helm-chartsVerified publisher0.1.31 of 3See more

firefly-iii kubernetes-homelab-helm-charts 0.1.3

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.6.6ae69fdd95cde
league/commonmark@2.8.2
2.10.2

Open the chart page →

5,495
sample-appkubeuest0.1.31 of 1See more

sample-app kubeuest 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
michaelepitech/sample-app:latestaf51d61c19f5
league/commonmark@1.6.7
2.10.2

Open the chart page →

2,173
librenmslibrenms10.2.11 of 5See more

librenms librenms 10.2.1

1 of the 5 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
librenms/librenms:26.9.1.1814e3fb8d837
league/commonmark@2.10.0
2.10.2

Open the chart page →

3,340
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
league/commonmark@2.4.0
2.10.2

Open the chart page →

14,394
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
league/commonmark@2.5.3
2.10.2

Open the chart page →

2,910
firefly-iiiphntom0.2.101 of 2See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/commonmark@2.3.0
2.10.2

Open the chart page →

2,619
laravel-workerrenoki-co1.1.01 of 1See more

laravel-worker renoki-co 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
league/commonmark@1.5.8
2.10.2

Open the chart page →

5,838
bookstackschmitzis0.1.11 of 1See more

bookstack schmitzis 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
solidnerd/bookstack:21.12762ffd5c51d3
league/commonmark@1.6.6
2.10.2

Open the chart page →

3,716
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
league/commonmark@2.7.1
2.10.2

Open the chart page →

69,216
repmanteam-blueVerified publisher0.3.01 of 5See more

repman team-blue 0.3.0

1 of the 5 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
buddy/repman:1.4.0097c897f8b54
league/commonmark@1.6.6
2.10.2

Open the chart page →

4,164
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/commonmark@2.3.3
2.10.2

Open the chart page →

2,932
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-105829.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/commonmark@2.8.1
2.10.2

Open the chart page →

1,588

Container images carrying it

45 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
buddy/repman:1.4.0097c897f8b54
league/commonmark@1.6.6
2.10.2
3
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2
2
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2
2
akaunting/akaunting:3.0.1552811b36ec3a
league/commonmark@2.4.0
2.10.2
1
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/commonmark@2.8.0
2.10.2
1
anonaddy/anonaddy:0.12.3957a95565166
league/commonmark@2.3.3
2.10.2
1
castopod/castopod:1.12.101fd37280cbb2
league/commonmark@2.5.3
2.10.2
1
castopod/castopod:1.15.54e4f0440520f
league/commonmark@2.8.0
2.10.2
1
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/commonmark@2.8.2
2.10.2
1
fireflyiii/core:version-5.6.142f4283bd0cf7
league/commonmark@2.2.1
2.10.2
1
fireflyiii/core:version-6.6.6ae69fdd95cde
league/commonmark@2.8.2
2.10.2
1
fireflyiii/core:version-5.7.12c0300cfd3d76
league/commonmark@2.3.5
2.10.2
1
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/commonmark@2.3.5
2.10.2
1
glpi/glpi:latest8888c5d8aa46
league/commonmark@2.10.0
2.10.2
1
invoiceninja/invoiceninja:5.6.241437916dee01
league/commonmark@2.4.0
2.10.2
1
leantime/leantime:3.3.3ad4bfb0699d3
league/commonmark@2.5.3
2.10.2
1
library/monica:4.1.2-fpm-alpine1104023d0636
league/commonmark@2.4.2
2.10.2
1
library/monica:3.7.0-apacheceb1ba4196ab
league/commonmark@2.2.1
2.10.2
1
librenms/librenms:24.11.00920bc9117a8
league/commonmark@2.5.3
2.10.2
1
librenms/librenms:22.4.14f1f3d667cc7
league/commonmark@1.6.7
2.10.2
1
librenms/librenms:26.9.1.1814e3fb8d837
league/commonmark@2.10.0
2.10.2
1
linkstackorg/linkstack:latest1c8b05399ee4
league/commonmark@2.8.0
2.10.2
1
linkstackorg/linkstack:latestabd691b4293b
league/commonmark@2.4.0
2.10.2
1
linuxserver/bookstack:26.05.202605282ebf97852661
league/commonmark@2.8.2
2.10.2
1
linuxserver/heimdall:2.8.33c9e97c416c7
league/commonmark@2.8.2
2.10.2
1
linuxserver/heimdall:2.6.371597f4461e4
league/commonmark@2.4.2
2.10.2
1
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
league/commonmark@1.5.8
2.10.2
1
michaelepitech/sample-app:latestaf51d61c19f5
league/commonmark@1.6.7
2.10.2
1
n22107670/sample-app:0.4.08f3072db7aeb
league/commonmark@1.6.7
2.10.2
1
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/commonmark@2.3.0
2.10.2
1
snipe/snipe-it:v8.3.1141ebf2386fe
league/commonmark@2.7.1
2.10.2
1
snipe/snipe-it:v6.0.1455fb7636a98c
league/commonmark@2.3.4
2.10.2
1
solidnerd/bookstack:21.12762ffd5c51d3
league/commonmark@1.6.6
2.10.2
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/commonmark@2.8.1
2.10.2
1
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/commonmark@2.6.1
2.10.2
1
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
league/commonmark@1.6.6
2.10.2
1
ghcr.io/linuxserver/snipe-it:version-v5.1.8ac091e4c33bd
league/commonmark@1.6.4
2.10.2
1
ghcr.io/monicahq/monica-next:main8a02508cbdcf
league/commonmark@2.7.1
2.10.2
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/commonmark@2.8.2
2.10.2
1
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
league/commonmark@1.6.6
2.10.2
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/commonmark@2.3.3
2.10.2
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/commonmark@2.3.0
2.10.2
1
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
league/commonmark@1.5.8
2.10.2
1
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
league/commonmark@1.5.8
2.10.2
1
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
league/commonmark@1.5.8
2.10.2
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.