StackRadar

CVE-2026-22029

High

Advisory

Published 8 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.0
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
2 of 2
affected packages

React Router vulnerable to XSS via Open Redirects

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
@remix-run/routernpm1.3.0, 1.4.0, 1.5.0, 1.6.3+8 more1.23.221
react-routernpm7.1.1, 7.6.0, 7.6.27.12.04
OSV records
GHSA-2w69-qvjg-hvjx

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
@remix-run/router@1.6.3
1.23.2

Open the chart page →

3,795
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@remix-run/router@1.15.0
1.23.2

Open the chart page →

2,654
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.12.0

Open the chart page →

7,949
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.12.0

Open the chart page →

1,152
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
@remix-run/router@1.23.0
1.23.2

Open the chart page →

6,873
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@remix-run/router@1.19.1
1.23.2

Open the chart page →

12,581
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@remix-run/router@1.21.0
1.23.2
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@remix-run/router@1.23.0
react-router@7.6.2
1.23.2
7.12.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@remix-run/router@1.23.0
react-router@7.6.2
1.23.2
7.12.0

Open the chart page →

18,293
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
@remix-run/router@1.3.0
1.23.2

Open the chart page →

9,146
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@remix-run/router@1.19.2
1.23.2

Open the chart page →

4,251
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
@remix-run/router@1.13.0
1.23.2

Open the chart page →

4,650
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
1.23.2

Open the chart page →

819
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
1.23.2

Open the chart page →

819
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@remix-run/router@1.15.0
1.23.2

Open the chart page →

2,950
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@remix-run/router@1.23.0
1.23.2

Open the chart page →

5,769
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
@remix-run/router@1.19.1
1.23.2

Open the chart page →

11,812
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
@remix-run/router@1.18.0
1.23.2

Open the chart page →

887
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@remix-run/router@1.5.0
1.23.2

Open the chart page →

17,929
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
@remix-run/router@1.7.2
1.23.2

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
@remix-run/router@1.7.2
1.23.2

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@remix-run/router@1.4.0
1.23.2

Open the chart page →

15,187
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@remix-run/router@1.19.2
1.23.2

Open the chart page →

3,271
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-22029.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@remix-run/router@1.19.2
1.23.2

Open the chart page →

5,497

Container images carrying it

23 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
1.23.2
2
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@remix-run/router@1.19.2
1.23.2
1
automatischio/automatisch:0.15.03bace7a12d5f
@remix-run/router@1.23.0
1.23.2
1
coldatom/containers-security-front:latest7c2fbbb41bcf
@remix-run/router@1.3.0
1.23.2
1
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.12.0
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
@remix-run/router@1.13.0
1.23.2
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@remix-run/router@1.5.0
1.23.2
1
kyleslugg/klusterview:latestba8c36dfdfbd
@remix-run/router@1.6.3
1.23.2
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@remix-run/router@1.19.2
1.23.2
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
@remix-run/router@1.19.1
1.23.2
1
vlebediantsev/notes-admin-front:latest007c6670ff48
@remix-run/router@1.7.2
1.23.2
1
vlebediantsev/notes-project-front:latest945675fd2636
@remix-run/router@1.7.2
1.23.2
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@remix-run/router@1.4.0
1.23.2
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@remix-run/router@1.15.0
1.23.2
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@remix-run/router@1.15.0
1.23.2
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@remix-run/router@1.21.0
1.23.2
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@remix-run/router@1.23.0
react-router@7.6.2
1.23.2
7.12.0
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@remix-run/router@1.23.0
react-router@7.6.2
1.23.2
7.12.0
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@remix-run/router@1.19.2
1.23.2
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@remix-run/router@1.19.1
1.23.2
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.12.0
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
@remix-run/router@1.18.0
1.23.2
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
@remix-run/router@1.23.0
1.23.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.