StackRadar

CVE-2026-27601

Medium

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
160
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Carried by container images the latest versions of 160 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.1.7, 1.4.4, 1.5.2, 1.6.0+13 more1.13.8135
underscoredeb1.13.4~dfsg+~1.11.4-3no fix listed22
OSV records
DEBIAN-CVE-2026-27601GHSA-qpx9-hpmf-5gmw

Charts affected

160 by stars
ChartLatestAffected imagesRadar Score
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
underscore@1.13.6
1.13.8

Open the chart page →

14,221
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
underscore@1.5.2
1.13.8

Open the chart page →

3,827
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
underscore@1.13.2
1.13.8

Open the chart page →

4,017
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
underscore@1.13.1
1.13.8

Open the chart page →

3,576
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
underscore@1.10.2
1.13.8

Open the chart page →

2,838
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
underscore@1.4.4
1.13.8

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
underscore@1.13.4
1.13.8

Open the chart page →

3,118
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
underscore@1.6.0
1.13.8

Open the chart page →

5,459
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
underscore@1.13.6
1.13.8

Open the chart page →

1,752

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
polonel/trudesk:1.2.60cf6513f6fe3
underscore@1.13.2
1.13.8
1
pretix/standalone:2026.7.05df3b7aa852e
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
prowlercloud/prowler-api:5.31.14f252d579be2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
requarks/wiki:canary-2.5.2438b5865a7386c
underscore@1.13.1
1.13.8
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
roadiehq/community-backstage-image:latestef355bf5b639
underscore@1.13.1
1.13.8
1
santisbon/evwatcher:latestc4e994ca4540
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
santisbon/evworker:lateste807283f8d69
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
santisbon/speedtest:latest8ee3a1697227
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
shinobisystems/shinobi:dev3ca746937856
underscore@1.4.4
1.13.8
1
shinobisystems/shinobi:latestc2f5ce2e1067
underscore@1.4.4
1.13.8
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
underscore@1.13.6
1.13.8
1
sqlpad/sqlpad:6.7d3d2f430dffd
underscore@1.13.1
1.13.8
1
stanfordoval/almond-server:latest1a63cdccedaf
underscore@1.4.4
1.13.8
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
underscore@1.13.2
1.13.8
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
underscore@1.12.1
1.13.8
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
underscore@1.13.6
1.13.8
1
wekanteam/wekan:v4.2268a51f0327df
underscore@1.7.0
1.13.8
1
ymuski/skooner:latest67819ca511b5
underscore@1.13.6
1.13.8
1
zazuko/trifid:2.3.7054be137de70
underscore@1.13.1
1.13.8
1
zooz/predator:1.6f491d1f7a865
underscore@1.13.1
1.13.8
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
underscore@1.4.4
1.13.8
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
ghcr.io/cjmalloy/jasper:v1.3.282726a947bb65b
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
underscore@1.13.7
1.13.8
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
underscore@1.13.7
1.13.8
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
underscore@1.4.4
1.13.8
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
underscore@1.4.4
1.13.8
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
underscore@1.4.4
1.13.8
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
underscore@1.4.4
1.13.8
1
ghcr.io/curium-rocks/kube-admission-controller-starter:maine9716966f30b
underscore@1.13.4
1.13.8
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
underscore@1.10.2
1.13.8
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
underscore@1.13.7
1.13.8
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
underscore@1.12.0
1.13.8
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
underscore@1.12.1
1.13.8
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
underscore@1.13.7
1.13.8
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
underscore@1.13.1
1.13.8
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
underscore@1.13.6
1.13.8
1
ghcr.io/middleware-labs/odigos-ui:middleware-test-0.0.787120a4561a9
underscore@1.13.4
1.13.8
1
ghcr.io/middleware-labs/vision-ui:middleware-test-0.0.853772b7b42c7
underscore@1.13.4
1.13.8
1
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
underscore@1.13.6
1.13.8
1
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
underscore@1.13.6
1.13.8
1
ghcr.io/mmontes11/iot-worker:v3.11.0491bb243f555
underscore@1.13.6
1.13.8
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
underscore@1.13.1
1.13.8
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
underscore@1.13.6
1.13.8
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
underscore@1.12.1
1.13.8
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
underscore@1.13.7
1.13.8
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
underscore@1.13.6
1.13.8
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
underscore@1.7.0
1.13.8
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
underscore@1.13.1
1.13.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.