StackRadar

CVE-2026-27601

Medium

Advisory

Published 3 Mar 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
160
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

Carried by container images the latest versions of 160 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.1.7, 1.4.4, 1.5.2, 1.6.0+13 more1.13.8135
underscoredeb1.13.4~dfsg+~1.11.4-3no fix listed22
OSV records
DEBIAN-CVE-2026-27601GHSA-qpx9-hpmf-5gmw

Charts affected

160 by stars
ChartLatestAffected imagesRadar Score
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.18.12-branch.testing3.88744-f55b3414bd113093583
underscore@1.13.6
1.13.8

Open the chart page →

14,221
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
underscore@1.5.2
1.13.8

Open the chart page →

3,827
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
underscore@1.13.2
1.13.8

Open the chart page →

4,017
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
underscore@1.13.1
1.13.8

Open the chart page →

3,576
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
underscore@1.10.2
1.13.8

Open the chart page →

2,838
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
underscore@1.4.4
1.13.8

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8

Open the chart page →

1,341
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
underscore@1.13.4
1.13.8

Open the chart page →

3,118
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
underscore@1.6.0
1.13.8

Open the chart page →

5,459
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27601.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
underscore@1.13.6
1.13.8

Open the chart page →

1,752

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
underscore@1.13.6
1.13.8
4
assistiot/dlt_api:2.0.0e36a8922fa0c
underscore@1.13.4
1.13.8
3
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.13.8
3
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
underscore@1.13.7
1.13.8
3
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.13.8
2
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.13.8
2
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.13.8
2
mojaloop/reporting:v12.1.0d480a62103d6
underscore@1.13.7
1.13.8
2
outlinewiki/outline:0.69.1d060dcd8f9aa
underscore@1.13.1
1.13.8
2
requarks/wiki:2:latest68f0d1848261
underscore@1.6.0
1.13.8
2
speckle/speckle-preview-service:2.18.11-branch.testing2.88634-335d469:2.18.12-branch.testing3.88744-f55b3414bd113093583
underscore@1.13.6
1.13.8
2
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.13.8
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
underscore@1.13.4
1.13.8
2
allegroai/clearml:2.0.0-613713ae38f7daf
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/dlt_api:2.1.0c8a170683be7
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
underscore@1.13.4
1.13.8
1
assistiot/smart-orchestrator_scheduler:latest38b003e55ff3
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
baserow/backend:1.31.1e0b3c8130b91
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
baserow/baserow:1.30.1df0c42eb67e8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
bnjbvr/kresus:0.22.137e216b182c8
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
catalysm/csmm:latestf003b35f54d9
underscore@1.13.1
1.13.8
1
codetogether/codetogether:latest4348c8a38752
underscore@1.13.1
1.13.8
1
coldatom/containers-security-api:latesteae9e82da080
underscore@1.13.6
1.13.8
1
countly/api:25.05.4f4cc7447c4f5
underscore@1.13.6
1.13.8
1
countly/countly-server:25.05.4e3c238248f99
underscore@1.13.6
1.13.8
1
countly/frontend:25.05.42acbc11499b6
underscore@1.13.6
1.13.8
1
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
underscore@1.7.0
1.13.8
1
cznic/knot-resolver:v6.4.2fe71c5214fdc
underscore@1.13.4~dfsg+~1.11.4-3
no fix listed
1
daskdev/dask-notebook:1.1.0052630f5ca04
underscore@1.9.1
1.13.8
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
underscore@1.7.0
1.13.8
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
underscore@1.13.4
1.13.8
1
ethersphere/bzz-token-service:latest7624f11a72ad
underscore@1.12.1
1.13.8
1
fallenbagel/jellyseerr:latest4538137bc5af
underscore@1.13.7
1.13.8
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
underscore@1.13.6
1.13.8
1
fanzynoodle/smeejas:0.0.15f9916c1a287
underscore@1.13.2
1.13.8
1
fiware/idm:8.3.3a1b6ed4ae84f
underscore@1.13.6
1.13.8
1
fiware/iotagent-json:3.1.0879b21a0d36d
underscore@1.12.1
1.13.8
1
fiware/iotagent-ul:1.14.0fe11f55a926d
underscore@1.9.1
1.13.8
1
folioci/mod-graphql:latestf0655a6a08fd
underscore@1.13.6
1.13.8
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
underscore@1.13.6
1.13.8
1
governify/collector-dynamic:v1.3.06d3d1a5b46a9
underscore@1.4.4
1.13.8
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.13.8
1
gristlabs/grist:0.7.96e71b1914a7e
underscore@1.12.1
1.13.8
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
underscore@1.12.1
1.13.8
1
ianw/quickchart:v1.7.1dc49dd460c37
underscore@1.12.1
1.13.8
1
ibmcom/bai-admin-dev:19.0.202d882f2836e
underscore@1.1.7
1.13.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.