StackRadar

CVE-2026-111766

Low

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,208 indexed, latest versions
Container images
114
deployed by those charts
Fix available
1 of 1
affected package

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Carried by container images the latest versions of 127 of 18,208 indexed charts deploy, on 114 images.

Affected packageAffected versionsFixed inImages
markdown-itnpm8.4.0, 8.4.2, 10.0.0, 11.0.1+16 more14.3.3, 15.0.3114
OSV records
GHSA-vfgh-jcmw-g37q

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
markdown-it@12.3.2
14.3.3

Open the chart page →

192,867
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
markdown-it@12.3.2
14.3.3

Open the chart page →

192,867
openclawcabrera-evil-chartsVerified publisher0.1.11 of 1See more

openclaw cabrera-evil-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:latestf40d1e66fd14
markdown-it@15.0.2
15.0.3

Open the chart page →

2,218
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latest68b19aee1c64
markdown-it@14.1.0
14.3.3

Open the chart page →

18,697
ghostchart-ghost0.1.71 of 2See more

ghost chart-ghost 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.69.0-alpine3.23db4c56c196d6
markdown-it@14.3.2
14.3.3

Open the chart page →

1,210
countlychristianhuthVerified publisher6.0.02 of 2See more

countly christianhuth 6.0.0

2 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
markdown-it@12.3.2
14.3.3
countly/frontend:25.05.42acbc11499b6
markdown-it@14.1.0
14.3.3

Open the chart page →

10,173
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.3

Open the chart page →

6,155
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.3

Open the chart page →

6,155
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.3

Open the chart page →

6,155
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
markdown-it@14.1.0
14.3.3

Open the chart page →

16,966
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
markdown-it@13.0.2
14.3.3

Open the chart page →

2,241
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
markdown-it@14.1.0
14.3.3

Open the chart page →

5,548
flanksource-uiflanksourceVerified publisher1.4.3541 of 1See more

flanksource-ui flanksource 1.4.354

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3542bb089c79fc0
markdown-it@14.3.0
14.3.3

Open the chart page →

3,515
mission-controlflanksourceVerified publisher0.1.3391 of 8See more

mission-control flanksource 0.1.339

1 of the 8 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.3228d17f0c08b20
markdown-it@14.3.0
14.3.3

Open the chart page →

11,784
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
markdown-it@12.3.2
14.3.3

Open the chart page →

38,624
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
markdown-it@14.0.0
14.3.3

Open the chart page →

10,823
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
markdown-it@8.4.2
14.3.3

Open the chart page →

24,246
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
markdown-it@8.4.2
14.3.3

Open the chart page →

26,696
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
markdown-it@12.3.2
14.3.3

Open the chart page →

2,941
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
markdown-it@12.3.2
14.3.3

Open the chart page →

2,941
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
markdown-it@11.0.1
14.3.3
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
markdown-it@11.0.1
14.3.3
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
markdown-it@11.0.1
14.3.3
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
markdown-it@11.0.1
14.3.3

Open the chart page →

91,915
countlyhelmforgeVerified publisher1.2.101 of 3See more

countly helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
markdown-it@14.1.0
14.3.3

Open the chart page →

74,720
ghosthelmforgeVerified publisher1.2.131 of 3See more

ghost helmforge 1.2.13

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.71.000032f157262
markdown-it@14.3.2
14.3.3

Open the chart page →

2,861
strapihelmforgeVerified publisher2.3.171 of 3See more

strapi helmforge 2.3.17

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.25a6c2c449840
markdown-it@14.3.0
14.3.3

Open the chart page →

2,574
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
markdown-it@11.0.1
14.3.3

Open the chart page →

4,613
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
markdown-it@12.2.0
14.3.3

Open the chart page →

5,997
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
markdown-it@8.4.2
14.3.3

Open the chart page →

2,522
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
markdown-it@14.1.1
14.3.3

Open the chart page →

4,779
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
markdown-it@8.4.0
14.3.3

Open the chart page →

6,935
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
markdown-it@14.1.1
14.3.3

Open the chart page →

4,290
ghostkubernetes-homelab-helm-chartsVerified publisher0.2.31 of 2See more

ghost kubernetes-homelab-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
markdown-it@14.1.1
14.3.3

Open the chart page →

4,281
efklovemew67Verified publisher0.0.11 of 2See more

efk lovemew67 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
markdown-it@12.3.2
14.3.3

Open the chart page →

4,507
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
markdown-it@8.4.2
14.3.3

Open the chart page →

8,195
searchmcp-helmVerified publisher0.1.31 of 2See more

search mcp-helm 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
laituanmanh/websearch-crawler:latest63b6da557c71
markdown-it@14.1.0
14.3.3

Open the chart page →

13,389
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.3

Open the chart page →

13,022
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.3

Open the chart page →

13,022
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
markdown-it@10.0.0
14.3.3

Open the chart page →

13,483
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
markdown-it@12.3.2
14.3.3

Open the chart page →

2,897
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
markdown-it@10.0.0
14.3.3
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
markdown-it@10.0.0
14.3.3
mojaloop/role-assignment-service:v2.1.0def4bf273721
markdown-it@10.0.0
14.3.3

Open the chart page →

16,804
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
markdown-it@10.0.0
14.3.3

Open the chart page →

12,410
mojaloopmojaloop14.0.03 of 6See more

mojaloop mojaloop 14.0.0

3 of the 6 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.3
mojaloop/central-ledger:v13.14.01abc8a7aa71c
markdown-it@10.0.0
14.3.3
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
markdown-it@10.0.0
14.3.3

Open the chart page →

21,013
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
markdown-it@10.0.0
14.3.3

Open the chart page →

3,018
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
markdown-it@10.0.0
14.3.3

Open the chart page →

2,884
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
markdown-it@10.0.0
14.3.3

Open the chart page →

2,594
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
markdown-it@12.3.2
14.3.3

Open the chart page →

2,897
mqtt-explorermqtt-explorerVerified publisher0.1.21 of 1See more

mqtt-explorer mqtt-explorer 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/thomasnordquist/mqtt-explorer:latest39a86744a7ba
markdown-it@12.3.2
14.3.3

Open the chart page →

1,549
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
markdown-it@14.1.0
14.3.3

Open the chart page →

6,484
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
markdown-it@13.0.1
14.3.3

Open the chart page →

3,892
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
markdown-it@13.0.2
14.3.3

Open the chart page →

2,510
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
markdown-it@14.1.1
14.3.3

Open the chart page →

5,106

Container images carrying it

114 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
markdown-it@14.1.1
14.3.3
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
markdown-it@14.3.2
14.3.3
1
ghcr.io/thomasnordquist/mqtt-explorer:latest39a86744a7ba
markdown-it@12.3.2
14.3.3
1
ghcr.io/wekan/wekan:v12.57e6fbfeb61089
markdown-it@15.0.2
15.0.3
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
markdown-it@14.1.0
14.3.3
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
markdown-it@14.1.0
14.3.3
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
markdown-it@14.1.0
14.3.3
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
markdown-it@14.2.0
14.3.3
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
markdown-it@12.2.0
14.3.3
1
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
markdown-it@14.3.0
14.3.3
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
markdown-it@13.0.2
14.3.3
1
quay.io/rhdh/rhdh-hub-rhel9:lateste992092fcc9b
markdown-it@14.1.1
14.3.3
1
quay.io/wekan/wekan:v5.65cb17600883a3
markdown-it@12.2.0
14.3.3
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
markdown-it@14.3.2
14.3.3
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.