StackRadar

CVE-2026-114109

Medium

Advisory

Published 29 May 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
28
of 18,219 indexed, latest versions
Container images
31
deployed by those charts
Fix available
2 of 2
affected packages

uv is vulnerable to arbitrary file write through entry point names

Carried by container images the latest versions of 28 of 18,219 indexed charts deploy, on 31 images.

Affected packageAffected versionsFixed inImages
uvpypi0.4.1, 0.4.29, 0.5.6, 0.5.27+15 more0.11.1527
uvcargo0.8.11, 0.10.11, 0.11.6, 0.11.11+2 more0.11.157
OSV records
GHSA-4gg8-gxpx-9rph

Charts affected

28 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.15

Open the chart page →

83,728
difydify-helmVerified publisher0.39.03 of 11See more

dify dify-helm 0.39.0

3 of the 11 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
uv@0.8.9
0.11.15
langgenius/dify-agent-local-sandbox:1.17.0316279a82ead
uv@0.8.9
0.11.15
langgenius/dify-api:1.17.052be6088dd84
uv@0.8.9
0.11.15

Open the chart page →

63,621
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.15

Open the chart page →

24,509
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.15

Open the chart page →

6,533
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
uv@0.11.6
0.11.15

Open the chart page →

8,119
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
uv@0.8.11
0.11.15

Open the chart page →

5,223
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.15

Open the chart page →

8,487
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
uv@0.11.14
uv@0.11.14
0.11.15
0.11.15

Open the chart page →

50,051
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.15
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.15

Open the chart page →

53,689
esphomealekcVerified publisher2.10.01 of 1See more

esphome alekc 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
esphome/esphome:2026.10.03a32372dfbd6
uv@0.10.1
0.11.15

Open the chart page →

3,839
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.15

Open the chart page →

138,645
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.15

Open the chart page →

18,379
kube-acp-stackcloudentity2.29.11 of 7See more

kube-acp-stack cloudentity 2.29.1

1 of the 7 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.15

Open the chart page →

25,510
csghubcsghubVerified publisher2.6.01 of 35See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
uv@0.7.20
0.11.15

Open the chart page →

68,963
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.11.15

Open the chart page →

4,025
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
uv@0.10.1
0.11.15

Open the chart page →

4,025
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.15

Open the chart page →

6,590
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
uv@0.11.6
0.11.15

Open the chart page →

7,429
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.15

Open the chart page →

50,047
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
uv@0.11.11
0.11.15
0.11.15

Open the chart page →

8,999
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
uv@0.5.6
0.11.15

Open the chart page →

7,235
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.15

Open the chart page →

64,516
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
uv@0.11.13
uv@0.11.13
0.11.15
0.11.15

Open the chart page →

2,145
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
uv@0.10.1
0.11.15

Open the chart page →

4,077
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.15

Open the chart page →

6,937
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.15

Open the chart page →

24,438
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
uv@0.10.6
0.11.15

Open the chart page →

6,004
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-114109.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
uv@0.10.11
0.11.15

Open the chart page →

1,855

Container images carrying it

31 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.15
1
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.15
1
esphome/esphome:2026.10.03a32372dfbd6
uv@0.10.1
0.11.15
1
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.11.15
1
grafana/oncall:v1.13.11159b6b836fed
uv@0.5.6
0.11.15
1
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.15
1
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
uv@0.8.9
0.11.15
1
langgenius/dify-agent-local-sandbox:1.17.0316279a82ead
uv@0.8.9
0.11.15
1
langgenius/dify-api:1.17.052be6088dd84
uv@0.8.9
0.11.15
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.15
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
uv@0.11.13
uv@0.11.13
0.11.15
0.11.15
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
uv@0.11.6
0.11.15
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
uv@0.11.6
0.11.15
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
uv@0.7.20
0.11.15
1
prowlercloud/prowler-api:5.31.14f252d579be2
uv@0.11.14
uv@0.11.14
0.11.15
0.11.15
1
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.15
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.15
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
uv@0.8.11
0.11.15
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.15
1
ghcr.io/esphome/esphome:latest776a845d5089
uv@0.10.1
0.11.15
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.15
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
uv@0.10.1
0.11.15
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.15
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.15
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
uv@0.10.6
0.11.15
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.15
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.15
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.15
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.15
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
uv@0.11.11
0.11.15
0.11.15
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
uv@0.10.11
0.11.15
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.