StackRadarChart IndexLive demo

CVE-2026-27122

Medium

Advisory

Published 19 Feb 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.1; base score, highest
EPSS: 0.002; 9th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 11; of 17,781 indexed, latest versions
Container images: 11; deployed by those charts
Fix available: 1 of 1; affected package

Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Carried by container images the latest versions of 11 of 17,781 indexed charts deploy, on 11 images.

Affected package	Affected versions	Fixed in	Images
sveltenpm	2.16.1, 3.59.1, 3.59.2, 4.2.19+1 more	5.51.5	11

OSV records: GHSA-m56q-vw4c-c2cp

Charts affected

11 by stars

Chart

Latest

Affected images

Radar Score

budibasebudibase

1 of 7 See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
budibase/apps :3.41.3	44fe6feab985	svelte@5.40.2	5.51.5

Open the chart page →

10,775

syftopenmined

1 of 6 See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
openmined/syft-frontend :0.9.5	d11524a3854a	svelte@3.59.2	5.51.5

Open the chart page →

17,245

kenerkener

1 of 1 See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	svelte@4.2.19	5.51.5

Open the chart page →

5,228

adventurelogdjjudas21

1 of 3 See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	svelte@4.2.19	5.51.5

Open the chart page →

7,459

kenerkener-chart

1 of 1 See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	svelte@4.2.19	5.51.5

Open the chart page →

5,228

semaphoreschoenwald

1 of 1 See more

semaphore schoenwald 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
0hlov3/semaphore :v1.0.0	50f874ec096b	svelte@2.16.1	5.51.5

Open the chart page →

1,796

codegentest-opea

1 of 5 See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
opea/codegen-ui :1.0	2bee4eb66f3e	svelte@3.59.2	5.51.5

Open the chart page →

28,814

codetranstest-opea

1 of 5 See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
opea/codetrans-ui :1.0	3ef121f34610	svelte@4.2.19	5.51.5

Open the chart page →

28,385

docsumtest-opea

1 of 5 See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
opea/docsum-ui :1.0	7f854e9bffaf	svelte@4.2.19	5.51.5

Open the chart page →

28,858

kenerunxwares

1 of 1 See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	svelte@4.2.19	5.51.5

Open the chart page →

5,228

workadventureworkadventure

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-27122.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	svelte@3.59.1	5.51.5
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	svelte@3.59.1	5.51.5

Open the chart page →

16,083

Container images carrying it

11 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
rajnandan1/kener :3.2.19	30407afca731	svelte@4.2.19	5.51.5	2
0hlov3/semaphore :v1.0.0	50f874ec096b	svelte@2.16.1	5.51.5	1
budibase/apps :3.41.3	44fe6feab985	svelte@5.40.2	5.51.5	1
opea/codegen-ui :1.0	2bee4eb66f3e	svelte@3.59.2	5.51.5	1
opea/codetrans-ui :1.0	3ef121f34610	svelte@4.2.19	5.51.5	1
opea/docsum-ui :1.0	7f854e9bffaf	svelte@4.2.19	5.51.5	1
openmined/syft-frontend :0.9.5	d11524a3854a	svelte@3.59.2	5.51.5	1
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	svelte@3.59.1	5.51.5	1
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	svelte@3.59.1	5.51.5	1
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	svelte@4.2.19	5.51.5	1
ghcr.io/seanmorley15/adventurelog-frontend :v0.13.0	51ee22428b41	svelte@4.2.19	5.51.5	1