StackRadarChart IndexLive demo

CVE-2026-112946

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026

Severity: Medium; worst across findings
CVSS: 6.3; base score, highest
EPSS: 0.009; 58th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 60; of 18,219 indexed, latest versions
Container images: 62; deployed by those charts
Fix available: 1 of 1; affected package

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Carried by container images the latest versions of 60 of 18,219 indexed charts deploy, on 62 images.

Affected package	Affected versions	Fixed in	Images
vitenpm	2.9.15, 3.2.5, 3.2.7, 3.2.8+39 more	6.4.4, 7.3.7, 8.1.6, 8.2.4+1 more	62

OSV records: GHSA-rq7h-c2jc-7f22

Charts affected

60 by stars

Chart

Latest

Affected images

Radar Score

slack-emoji-makersuminhong

1 of 1 See more

slack-emoji-maker suminhong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
honglab/slack-emoji-maker :v0.0.1	ca075a926fe1	vite@4.5.13	6.4.4

Open the chart page →

2,561

tensorzerotensorzero

1 of 2 See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
tensorzero/ui :2026.6.0	f2563d54724e	vite@7.3.2	7.3.7

Open the chart page →

5,232

codegentest-opea

1 of 5 See more

106,449

codetranstest-opea

1 of 5 See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
opea/codetrans-ui :1.0	3ef121f34610	vite@5.4.6	6.4.4

Open the chart page →

105,973

docsumtest-opea

1 of 5 See more

106,476

homepagethis-is-tobi-helm-charts

1 of 1 See more

homepage this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v2.4.0	643bd0be730d	vite@8.2.1	8.2.4

Open the chart page →

734

homepageunknowniq

1 of 2 See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
ghcr.io/gethomepage/homepage :v2.2.0	753eeb0cc22a	vite@8.2.1	8.2.4

Open the chart page →

751

kenerunxwares

1 of 2 See more

kener unxwares 2026.10.1

1 of the 2 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
rajnandan1/kener :4.1.7-alpine	d920a2b71c20	vite@7.3.1	7.3.7

Open the chart page →

1,971

workadventure-adminwork-adventure

1 of 14 See more

workadventure-admin work-adventure 1.0.0-21-3

1 of the 14 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :helm-chart	519c31c6e7ec	vite@3.2.8	6.4.4

Open the chart page →

20,881

workadventureworkadventure

1 of 9 See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2026-112946.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	vite@3.2.7	6.4.4

Open the chart page →

21,553

Container images carrying it

62 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/manzil-infinity180/frontend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	4e6394b715d9	vite@5.4.8	6.4.4	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	vite@8.0.14	8.1.6	1
ghcr.io/papra-hq/papra :26.7.0-rootless	bf4a66e776d0	vite@8.1.0	8.1.6	1
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	vite@4.5.9	6.4.4	1
ghcr.io/rybbit-io/rybbit-backend :latest	e0d1b397e33c	vite@7.2.7	7.3.7	1
ghcr.io/tale/headplane :0.5.5	0dbc52cffc19	vite@6.0.6	6.4.4	1
ghcr.io/thm-mni-ii/fbs-qcm-frontend :v2.0.9	083d81d517e7	vite@5.4.11	6.4.4	1
ghcr.io/vincenttaglia/indexer-tools :v3.4.4	5bae30456ddb	vite@3.2.5	6.4.4	1
ghcr.io/wei-shaw/claude-relay-service :v1.1.292	398c34934453	vite@5.4.19	6.4.4	1
ghcr.io/wgbh-mla/dream-aapb :main	23a86c7a0b8a	vite@7.3.1	7.3.7	1
ghcr.io/wgbh-mla/ov-frontend :v1.1.0	bfc3118f6565	vite@6.3.5	6.4.4	1
ghcr.io/xmv-solutions-gmbh/strapi :latest	5ffcc95d11e8	vite@5.4.21	6.4.4	1