StackRadar

CVE-2026-111766

Low

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.004
27th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,208 indexed, latest versions
Container images
114
deployed by those charts
Fix available
1 of 1
affected package

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

Carried by container images the latest versions of 127 of 18,208 indexed charts deploy, on 114 images.

Affected packageAffected versionsFixed inImages
markdown-itnpm8.4.0, 8.4.2, 10.0.0, 11.0.1+16 more14.3.3, 15.0.3114
OSV records
GHSA-vfgh-jcmw-g37q

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
audacitynicholaswildeVerified publisher0.1.41 of 1See more

audacity nicholaswilde 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/audacity:version-3.0.2cdf203db1e50
markdown-it@12.1.0
14.3.3

Open the chart page →

25,298
digikamnicholaswildeVerified publisher1.0.01 of 1See more

digikam nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/digikam:version-7.3.055b4c7f320ae
markdown-it@12.2.0
14.3.3

Open the chart page →

27,542
doublecommandernicholaswildeVerified publisher1.0.21 of 1See more

doublecommander nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/doublecommander:version-0.8.2-1d92969a929c2
markdown-it@12.3.0
14.3.3

Open the chart page →

28,714
filezillanicholaswildeVerified publisher1.0.11 of 1See more

filezilla nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/filezilla:version-3.51.0-r15103cdd266ce
markdown-it@12.2.0
14.3.3

Open the chart page →

4,492
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
markdown-it@10.0.0
14.3.3

Open the chart page →

29,734
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
markdown-it@12.2.0
14.3.3

Open the chart page →

10,598
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
markdown-it@13.0.2
14.3.3

Open the chart page →

2,510
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
markdown-it@12.3.2
14.3.3

Open the chart page →

4,489
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
markdown-it@13.0.1
14.3.3

Open the chart page →

8,147
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
markdown-it@14.3.2
14.3.3

Open the chart page →

2,643
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
markdown-it@13.0.2
14.3.3

Open the chart page →

8,157
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
markdown-it@14.1.0
14.3.3

Open the chart page →

5,339
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
markdown-it@13.0.1
14.3.3

Open the chart page →

3,500
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
markdown-it@13.0.1
14.3.3

Open the chart page →

5,649
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
markdown-it@12.2.0
14.3.3

Open the chart page →

3,903
joplin-serverschoenwald1.0.31 of 1See more

joplin-server schoenwald 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
markdown-it@13.0.2
14.3.3

Open the chart page →

2,969
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
markdown-it@14.3.0
14.3.3

Open the chart page →

3,931
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
markdown-it@14.2.0
14.3.3

Open the chart page →

701
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
supabase/studio:latestd878dcd9dba7
markdown-it@14.3.2
14.3.3

Open the chart page →

10,684
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
markdown-it@13.0.2
14.3.3

Open the chart page →

6,275
learning-fluentdtungntt0.1.01 of 4See more

learning-fluentd tungntt 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/kibana:7.9.1b1bbcaa57738
markdown-it@10.0.0
14.3.3

Open the chart page →

8,527
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
markdown-it@14.2.0
14.3.3

Open the chart page →

6,871
devportalveecode-platform-nextVerified publisher1.1.11 of 1See more

devportal veecode-platform-next 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedfe33373b7e5d
markdown-it@14.2.0
14.3.3

Open the chart page →

1,669
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
markdown-it@13.0.1
14.3.3

Open the chart page →

3,500
wikiwener2.2.01 of 2See more

wiki wener 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
requarks/wiki:latestfffff288a52f
markdown-it@11.0.1
14.3.3

Open the chart page →

2,634
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
requarks/wiki:2fffff288a52f
markdown-it@11.0.1
14.3.3

Open the chart page →

4,382
kibanawiremindVerified publisher8.5.241 of 2See more

kibana wiremind 8.5.24

1 of the 2 container images this version deploys carry CVE-2026-111766.

Container imageDigestPackageFixed in
library/kibana:8.19.224116dd6a5838
markdown-it@14.2.0
14.3.3

Open the chart page →

1,727

Container images carrying it

114 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
markdown-it@14.1.1
14.3.3
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
markdown-it@14.3.2
14.3.3
1
ghcr.io/thomasnordquist/mqtt-explorer:latest39a86744a7ba
markdown-it@12.3.2
14.3.3
1
ghcr.io/wekan/wekan:v12.57e6fbfeb61089
markdown-it@15.0.2
15.0.3
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
markdown-it@14.1.0
14.3.3
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
markdown-it@14.1.0
14.3.3
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
markdown-it@14.1.0
14.3.3
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
markdown-it@14.2.0
14.3.3
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
markdown-it@12.2.0
14.3.3
1
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
markdown-it@14.3.0
14.3.3
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
markdown-it@13.0.2
14.3.3
1
quay.io/rhdh/rhdh-hub-rhel9:lateste992092fcc9b
markdown-it@14.1.1
14.3.3
1
quay.io/wekan/wekan:v5.65cb17600883a3
markdown-it@12.2.0
14.3.3
1
registry.gitlab.com/xrow-public/ci-tools/tools:main90a7a94db2b0
markdown-it@14.3.2
14.3.3
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.