StackRadar

CVE-2026-112946

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.009
58th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
60
of 18,219 indexed, latest versions
Container images
62
deployed by those charts
Fix available
1 of 1
affected package

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Carried by container images the latest versions of 60 of 18,219 indexed charts deploy, on 62 images.

Affected packageAffected versionsFixed inImages
vitenpm2.9.15, 3.2.5, 3.2.7, 3.2.8+39 more6.4.4, 7.3.7, 8.1.6, 8.2.4+1 more62
OSV records
GHSA-rq7h-c2jc-7f22

Charts affected

60 by stars
ChartLatestAffected imagesRadar Score
penpotpenpotOfficialVerified publisher1.11.31 of 5See more

penpot penpot 1.11.3

1 of the 5 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
penpotapp/admin-console:2.18.35935b5adbf33
vite@8.3.0
8.3.3

Open the chart page →

6,137
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
vite@8.0.14
8.1.6

Open the chart page →

6,739
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
vite@5.4.12
6.4.4

Open the chart page →

6,499
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
vite@4.1.3
6.4.4

Open the chart page →

5,686
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
vite@4.5.3
6.4.4

Open the chart page →

22,008
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
vite@6.0.6
6.4.4

Open the chart page →

10,371
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
vite@8.0.16
8.1.6

Open the chart page →

10,388
feedbacksystemthm-mni-iiVerified publisher0.48.31 of 14See more

feedbacksystem thm-mni-ii 0.48.3

1 of the 14 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/thm-mni-ii/fbs-qcm-frontend:v2.0.9083d81d517e7
vite@5.4.11
6.4.4

Open the chart page →

30,473
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main23a86c7a0b8a
vite@7.3.1
7.3.7

Open the chart page →

1,024
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
vite@8.2.0
8.2.4

Open the chart page →

8,119
betterdb-monitorbetterdb-monitorOfficialVerified publisher0.51.11 of 1See more

betterdb-monitor betterdb-monitor 0.51.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
betterdb/monitor:0.51.1-no-aic4910692b3fc
vite@8.0.16
8.1.6

Open the chart page →

367
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
vite@8.2.2
8.2.4

Open the chart page →

12,921
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
vite@8.0.8
8.1.6

Open the chart page →

9,931
jellystatdjjudas21Verified publisher1.0.11 of 1See more

jellystat djjudas21 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.12e61c759ec706
vite@8.0.16
8.1.6

Open the chart page →

2,173
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
vite@7.1.12
7.3.7

Open the chart page →

2,338
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
vite@4.5.9
6.4.4

Open the chart page →

6,380
plane-enterprisemakeplaneOfficialVerified publisher3.10.123 of 13See more

plane-enterprise makeplane 3.10.12

3 of the 13 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.3fab034a2be8c
vite@8.2.2
8.2.4
makeplane/silo-commercial:v3.3.312c33418c1ec
vite@8.2.2
8.2.4
makeplane/space-commercial:v3.3.3c4a6236c4080
vite@8.2.2
8.2.4

Open the chart page →

7,311
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
vite@6.3.5
6.4.4

Open the chart page →

61,541
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
vite@7.3.1
7.3.7

Open the chart page →

4,477
activepiecesadnoctemVerified publisher0.7.21 of 1See more

activepieces adnoctem 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
activepieces/activepieces:0.92.326daa5e1807f
vite@6.4.3
6.4.4

Open the chart page →

2,047
outlineadnoctemVerified publisher0.1.31 of 1See more

outline adnoctem 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
outlinewiki/outline:1.11.008ee9ffdb847
vite@8.3.2
8.3.3

Open the chart page →

1,628
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
vite@5.1.4
6.4.4

Open the chart page →

102,399
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
vite@5.4.11
6.4.4
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
vite@6.3.6
6.4.4
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
vite@6.3.6
6.4.4

Open the chart page →

23,316
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
vite@4.5.2
6.4.4

Open the chart page →

5,617
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
vite@5.4.8
6.4.4

Open the chart page →

5,263
lodestarethereum-helm-chartsVerified publisher1.2.21 of 2See more

lodestar ethereum-helm-charts 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
chainsafe/lodestar:latestf3d339e96267
vite@6.1.6
6.4.4

Open the chart page →

3,258
facetflanksourceVerified publisher0.1.731 of 1See more

facet flanksource 0.1.73

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
vite@6.4.3
6.4.4

Open the chart page →

29,576
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
vite@8.2.2
8.2.4

Open the chart page →

1,448
automatischhelmforgeVerified publisher1.3.121 of 4See more

automatisch helmforge 1.3.12

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
vite@6.3.3
6.4.4

Open the chart page →

6,522
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
vite@8.2.0
8.2.4

Open the chart page →

7,429
opensignhelmforgeVerified publisher1.0.01 of 3See more

opensign helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
opensign/opensigndigest-pinned0ebc230eed21
vite@8.2.1
8.2.4

Open the chart page →

69,345
paprahelmforgeVerified publisher1.0.21 of 1See more

papra helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.7.0-rootlessbf4a66e776d0
vite@8.1.0
8.1.6

Open the chart page →

3,685
reactive-resumehelmforgeVerified publisher1.0.21 of 4See more

reactive-resume helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
vite@8.2.2
8.2.4

Open the chart page →

4,028
ryothelmforgeVerified publisher1.0.21 of 2See more

ryot helmforge 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
vite@6.0.11
6.4.4

Open the chart page →

7,267
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
vite@2.9.15
6.4.4

Open the chart page →

79,005
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
vite@2.9.15
6.4.4

Open the chart page →

83,823
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
vite@4.0.4
6.4.4

Open the chart page →

6,041
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
vite@4.5.9
6.4.4

Open the chart page →

6,380
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
vite@6.4.3
6.4.4
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
vite@6.4.3
6.4.4

Open the chart page →

4,200
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
vite@5.0.12
6.4.4

Open the chart page →

5,502
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
vite@7.3.1
7.3.7

Open the chart page →

5,011
indexer-toolsnodeifyVerified publisher2.1.11 of 1See more

indexer-tools nodeify 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
vite@3.2.5
6.4.4

Open the chart page →

4,042
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
vite@5.4.4
6.4.4

Open the chart page →

4,630
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
sharanalwar/redchef-frontend:latest5e82950b16b7
vite@6.2.6
6.4.4

Open the chart page →

5,725
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
vite@5.4.3
6.4.4

Open the chart page →

65,574
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
vite@5.4.19
6.4.4

Open the chart page →

6,205
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
vite@7.2.7
7.3.7

Open the chart page →

9,153
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
vite@4.1.3
6.4.4

Open the chart page →

5,686
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
vite@5.3.6
6.4.4

Open the chart page →

5,109
strapistrapi-xmv0.1.21 of 1See more

strapi strapi-xmv 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container imageDigestPackageFixed in
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
vite@5.4.21
6.4.4

Open the chart page →

754

Container images carrying it

62 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
openbas/caldera-server:5.1.0a277796d9724
vite@2.9.15
6.4.4
2
outlinewiki/outline:0.69.1d060dcd8f9aa
vite@4.1.3
6.4.4
2
patrikx3/p3x-redis-ui:latestf19eb45b0694
vite@8.2.2
8.2.4
2
activepieces/activepieces:0.92.326daa5e1807f
vite@6.4.3
6.4.4
1
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
vite@7.3.1
7.3.7
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
vite@5.4.4
6.4.4
1
automatischio/automatisch:0.15.03bace7a12d5f
vite@6.3.3
6.4.4
1
betterdb/monitor:0.51.1-no-aic4910692b3fc
vite@8.0.16
8.1.6
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
vite@5.3.6
6.4.4
1
chainsafe/lodestar:latestf3d339e96267
vite@6.1.6
6.4.4
1
cyfershepard/jellystat:1.1.12e61c759ec706
vite@8.0.16
8.1.6
1
directus/directus:12.0.29c8470ea465c
vite@8.0.8
8.1.6
1
directus/directus:11.1.0e3c8bb975350
vite@4.5.2
6.4.4
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
vite@4.0.4
6.4.4
1
ethpandaops/ethereumjs:masterfb84b718500f
vite@7.1.12
7.3.7
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
vite@4.5.13
6.4.4
1
makeplane/live-commercial:v3.3.3fab034a2be8c
vite@8.2.2
8.2.4
1
makeplane/silo-commercial:v3.3.312c33418c1ec
vite@8.2.2
8.2.4
1
makeplane/space-commercial:v3.3.3c4a6236c4080
vite@8.2.2
8.2.4
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
vite@5.0.12
6.4.4
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
vite@8.2.0
8.2.4
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
vite@8.2.0
8.2.4
1
opea/codegen-ui:1.02bee4eb66f3e
vite@4.5.5
6.4.4
1
opea/codetrans-ui:1.03ef121f34610
vite@5.4.6
6.4.4
1
opea/docsum-ui:1.07f854e9bffaf
vite@5.4.6
6.4.4
1
openmined/syft-frontend:0.9.5d11524a3854a
vite@4.5.3
6.4.4
1
opensign/opensign0ebc230eed21
vite@8.2.1
8.2.4
1
outlinewiki/outline:1.11.008ee9ffdb847
vite@8.3.2
8.3.3
1
outlinewiki/outline:0.82.0494dfb9249a6
vite@5.4.12
6.4.4
1
penpotapp/admin-console:2.18.0:2.18.1:2.18.2:2.18.35935b5adbf33
vite@8.3.0
8.3.3
1
pretix/standalone:2026.8.0ec17c2f761f7
vite@8.0.16
8.1.6
1
rajnandan1/kener:3.2.1930407afca731
vite@4.5.9
6.4.4
1
rajnandan1/kener:4.1.7-alpined920a2b71c20
vite@7.3.1
7.3.7
1
sharanalwar/redchef-frontend:latest5e82950b16b7
vite@6.2.6
6.4.4
1
tensorzero/ui:2026.6.0f2563d54724e
vite@7.3.2
7.3.7
1
thecodingmachine/workadventure-map-storage:helm-chart519c31c6e7ec
vite@3.2.8
6.4.4
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
vite@3.2.7
6.4.4
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
vite@8.2.2
8.2.4
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
vite@7.3.1
7.3.7
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
vite@5.1.4
6.4.4
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
vite@6.4.3
6.4.4
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
vite@5.4.11
6.4.4
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
vite@6.3.6
6.4.4
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
vite@6.3.6
6.4.4
1
ghcr.io/gethomepage/homepage:latest:v2.4.0643bd0be730d
vite@8.2.1
8.2.4
1
ghcr.io/gethomepage/homepage:latest:v2.2.0753eeb0cc22a
vite@8.2.1
8.2.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
vite@6.0.11
6.4.4
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
vite@5.4.3
6.4.4
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
vite@6.4.3
6.4.4
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
vite@6.4.3
6.4.4
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.