StackRadar

CVE-2026-113661

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
5.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 18,208 indexed, latest versions
Container images
64
deployed by those charts
Fix available
1 of 1
affected package

ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs

Carried by container images the latest versions of 70 of 18,208 indexed charts deploy, on 64 images.

Affected packageAffected versionsFixed inImages
sanitize-htmlnpm1.4.2, 1.14.1, 1.18.5, 1.19.1+13 more2.18.064
OSV records
GHSA-cv27-6wvh-8x7j

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.431 of 1See more

n8n community-charts 1.24.43

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.687e0bab2c931
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,634
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
sanitize-html@2.17.5
2.18.0

Open the chart page →

2,510
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sanitize-html@2.13.0
2.18.0

Open the chart page →

8,180
n8nhelmforgeVerified publisher2.1.81 of 2See more

n8n helmforge 2.1.8

1 of the 2 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:2.44.4c72fa9f1bd9b
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,079
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
microcks/microcks-postman-runtime:latestcb72e46a1b3c
sanitize-html@1.14.1
2.18.0

Open the chart page →

10,854
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sanitize-html@2.7.0
2.18.0

Open the chart page →

5,653
dialdialOfficialVerified publisher8.1.01 of 4See more

dial dial 8.1.0

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
epam/ai-dial-chat:1.2.4df205138325d
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,779
ghostcloudpirates-ghostVerified publisher0.20.291 of 3See more

ghost cloudpirates-ghost 0.20.29

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.69.055131b90d48c
sanitize-html@2.17.7
2.18.0

Open the chart page →

8,932
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher2.0.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,626
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
sanitize-html@2.7.0
2.18.0

Open the chart page →

8,550
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
sanitize-html@2.17.6
2.18.0

Open the chart page →

7,885
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sanitize-html@2.11.0
2.18.0
ghcr.io/data-fair/portals:18b621866ceb2
sanitize-html@1.27.5
2.18.0

Open the chart page →

43,506
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sanitize-html@2.17.0
2.18.0

Open the chart page →

9,890
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sanitize-html@2.7.0
2.18.0

Open the chart page →

4,981
ghostgroundhog2k0.212.181 of 1See more

ghost groundhog2k 0.212.18

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.71.000032f157262
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,954
n8nklicktippVerified publisher1.11.11 of 1See more

n8n klicktipp 1.11.1

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:2.43.3d4eca183959b
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,634
plane-enterprisemakeplaneOfficialVerified publisher3.10.113 of 13See more

plane-enterprise makeplane 3.10.11

3 of the 13 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.3fab034a2be8c
sanitize-html@2.17.7
2.18.0
makeplane/silo-commercial:v3.3.312c33418c1ec
sanitize-html@2.17.7
2.18.0
makeplane/space-commercial:v3.3.3c4a6236c4080
sanitize-html@2.17.7
2.18.0

Open the chart page →

7,053
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
sanitize-html@2.12.1
2.18.0

Open the chart page →

4,286
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sanitize-html@2.17.1
2.18.0

Open the chart page →

8,587
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sanitize-html@2.12.1
2.18.0

Open the chart page →

11,457
ghostchart-ghost0.1.71 of 2See more

ghost chart-ghost 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.69.0-alpine3.23db4c56c196d6
sanitize-html@2.17.7
2.18.0

Open the chart page →

1,210
daskcloudnativeapp2.2.11 of 2See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
daskdev/dask-notebook:1.1.0052630f5ca04
sanitize-html@1.18.5
2.18.0

Open the chart page →

31,885
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sanitize-html@2.11.0
2.18.0

Open the chart page →

6,155
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sanitize-html@2.11.0
2.18.0

Open the chart page →

6,155
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
sanitize-html@2.11.0
2.18.0

Open the chart page →

6,155
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
sanitize-html@2.13.0
2.18.0

Open the chart page →

5,572
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
sanitize-html@1.19.1
2.18.0

Open the chart page →

13,011
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
sanitize-html@2.11.0
2.18.0

Open the chart page →

10,823
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
sanitize-html@1.27.5
2.18.0

Open the chart page →

24,246
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
sanitize-html@1.27.5
2.18.0

Open the chart page →

26,696
ghosthelmforgeVerified publisher1.2.131 of 3See more

ghost helmforge 1.2.13

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.71.000032f157262
sanitize-html@2.17.7
2.18.0

Open the chart page →

2,861
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
sanitize-html@2.17.7
2.18.0

Open the chart page →

7,193
reactive-resumehelmforgeVerified publisher1.0.21 of 4See more

reactive-resume helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
sanitize-html@2.17.7
2.18.0

Open the chart page →

3,964
twentyhelmforgeVerified publisher1.0.91 of 5See more

twenty helmforge 1.0.9

1 of the 5 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.49.080e1b33b0b4b
sanitize-html@2.17.7
2.18.0

Open the chart page →

2,793
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
sanitize-html@2.17.0
2.18.0

Open the chart page →

4,779
n8njanip81-helm-chartsVerified publisher0.1.51 of 1See more

n8n janip81-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
sanitize-html@2.12.1
2.18.0

Open the chart page →

7,201
juice-shopjuice-shop5.9.01 of 1See more

juice-shop juice-shop 5.9.0

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
bkimminich/juice-shop:v20.2.08739101ade29
sanitize-html@1.4.2
2.18.0

Open the chart page →

2,029
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
sanitize-html@2.17.4
2.18.0

Open the chart page →

4,290
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
sanitize-html@2.7.0
2.18.0

Open the chart page →

6,753
ghostkubernetes-homelab-helm-chartsVerified publisher0.2.31 of 2See more

ghost kubernetes-homelab-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
sanitize-html@2.17.0
2.18.0

Open the chart page →

4,281
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
sanitize-html@1.27.5
2.18.0

Open the chart page →

13,022
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
sanitize-html@1.27.5
2.18.0

Open the chart page →

13,022
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
sanitize-html@1.27.5
2.18.0

Open the chart page →

13,483
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
sanitize-html@2.12.1
2.18.0

Open the chart page →

2,897
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
sanitize-html@1.27.5
2.18.0
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
sanitize-html@1.27.5
2.18.0
mojaloop/role-assignment-service:v2.1.0def4bf273721
sanitize-html@1.27.5
2.18.0

Open the chart page →

16,804
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
sanitize-html@1.27.5
2.18.0

Open the chart page →

12,410
mojaloopmojaloop14.0.03 of 6See more

mojaloop mojaloop 14.0.0

3 of the 6 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
sanitize-html@1.27.5
2.18.0
mojaloop/central-ledger:v13.14.01abc8a7aa71c
sanitize-html@1.27.5
2.18.0
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
sanitize-html@1.27.5
2.18.0

Open the chart page →

21,013
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
sanitize-html@1.27.5
2.18.0

Open the chart page →

3,018
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
sanitize-html@1.27.5
2.18.0

Open the chart page →

2,884
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-113661.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
sanitize-html@1.27.5
2.18.0

Open the chart page →

2,594

Container images carrying it

64 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
sanitize-html@2.12.1
2.18.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
sanitize-html@2.12.1
2.18.0
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
sanitize-html@2.7.0
2.18.0
1
twentycrm/twenty:latest7ea7839b8945
sanitize-html@2.17.7
2.18.0
1
twentycrm/twenty:v2.49.080e1b33b0b4b
sanitize-html@2.17.7
2.18.0
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
sanitize-html@2.17.7
2.18.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sanitize-html@2.11.0
2.18.0
1
ghcr.io/data-fair/portals:18b621866ceb2
sanitize-html@1.27.5
2.18.0
1
ghcr.io/quenchworks/images/xyopsec6c76854898
sanitize-html@2.17.7
2.18.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main305999dea18a
sanitize-html@2.17.7
2.18.0
1
ghcr.io/xmv-solutions-gmbh/strapi:latest5ffcc95d11e8
sanitize-html@2.13.0
2.18.0
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sanitize-html@2.3.3
2.18.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.