StackRadar

CVE-2026-19693

High

Advisory

Published 17 Aug 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
75
of 17,781 indexed, latest versions
Container images
74
deployed by those charts
Fix available
None
affected package

extract-zip allows arbitrary file writes through symlink archive entries

Carried by container images the latest versions of 75 of 17,781 indexed charts deploy, on 74 images.

Affected packageAffected versionsFixed inImages
extract-zipnpm1.5.0, 1.6.5, 1.6.6, 1.6.7+2 moreno fix listed74
OSV records
GHSA-7pqw-9j4j-h8q3

Charts affected

75 by stars
ChartLatestAffected imagesRadar Score
monocularmonocular1.4.151 of 5See more

monocular monocular 1.4.15

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
extract-zip@1.5.0
no fix listed

Open the chart page →

7,048
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
extract-zip@2.0.1
no fix listed

Open the chart page →

4,560
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
extract-zip@2.0.1
no fix listed

Open the chart page →

4,960
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
extract-zip@2.0.1
no fix listed

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
extract-zip@2.0.1
no fix listed

Open the chart page →

6,583
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
extract-zip@1.7.0
no fix listed

Open the chart page →

6,524
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
extract-zip@1.7.0
no fix listed

Open the chart page →

5,215
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
extract-zip@1.7.0
no fix listed

Open the chart page →

9,047
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
extract-zip@2.0.1
no fix listed

Open the chart page →

5,819
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
extract-zip@2.0.1
no fix listed

Open the chart page →

4,684
speckle-preview-service-branch-testing6speckleVerified publisher2.23.14-branch.testing6.334655-b4e04ee1 of 1See more

speckle-preview-service-branch-testing6 speckle 2.23.14-branch.testing6.334655-b4e04ee

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
extract-zip@2.0.1
no fix listed

Open the chart page →

5,950
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
extract-zip@2.0.1
no fix listed

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
extract-zip@2.0.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
extract-zip@2.0.1
no fix listed

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
extract-zip@2.0.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d4694bd113093583
extract-zip@2.0.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
extract-zip@2.0.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
extract-zip@2.0.1
no fix listed

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
extract-zip@2.0.1
no fix listed

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
extract-zip@2.0.1
no fix listed

Open the chart page →

11,100
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
extract-zip@2.0.1
no fix listed

Open the chart page →

4,052
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
extract-zip@2.0.1
no fix listed

Open the chart page →

4,305
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
extract-zip@2.0.1
no fix listed

Open the chart page →

6,285
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
extract-zip@1.7.0
no fix listed

Open the chart page →

5,806
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-19693.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latestf166a963b550
extract-zip@2.0.1
no fix listed

Open the chart page →

1,589

Container images carrying it

74 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
extract-zip@2.0.1
no fix listed
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
extract-zip@2.0.1
no fix listed
1
treskon/portrait-ui:DEV-lateste7970783bc8d
extract-zip@2.0.1
no fix listed
1
wazuh/wazuh-dashboard:4.11.10c58e7b47bb6
extract-zip@2.0.1
no fix listed
1
wazuh/wazuh-dashboard:4.4.11787550d2358
extract-zip@2.0.1
no fix listed
1
wekanteam/wekan:v4.2268a51f0327df
extract-zip@1.6.7
no fix listed
1
yuzutech/kroki-bpmn:0.29.1444805c4b917
extract-zip@2.0.1
no fix listed
1
yuzutech/kroki-diagramsnet:0.29.1b810edbf9c62
extract-zip@2.0.1
no fix listed
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
extract-zip@2.0.1
no fix listed
1
yuzutech/kroki-mermaid:0.29.1963b4acfde6e
extract-zip@2.0.1
no fix listed
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
extract-zip@2.0.1
no fix listed
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
extract-zip@2.0.1
no fix listed
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
extract-zip@2.0.1
no fix listed
1
ghcr.io/flaresolverr/flaresolverr:v1.2.896f8c08c0c1b
extract-zip@2.0.1
no fix listed
1
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
extract-zip@2.0.1
no fix listed
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
extract-zip@2.0.1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
extract-zip@2.0.1
no fix listed
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
extract-zip@2.0.1
no fix listed
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
extract-zip@2.0.1
no fix listed
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
extract-zip@2.0.1
no fix listed
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
extract-zip@2.0.1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
extract-zip@2.0.1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
extract-zip@2.0.1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
extract-zip@2.0.1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.