StackRadar

CVE-2026-28291

High

Advisory

Published 13 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.008
56th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
19
of 17,781 indexed, latest versions
Container images
17
deployed by those charts
Fix available
1 of 1
affected package

simple-git Affected by Command Execution via Option-Parsing Bypass

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 17 images.

Affected packageAffected versionsFixed inImages
simple-gitnpm1.92.0, 1.122.0, 1.132.0, 2.21.0+9 more3.32.017
OSV records
GHSA-jcxm-m3jx-f287

Charts affected

19 by stars
ChartLatestAffected imagesRadar Score
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
simple-git@3.17.0
3.32.0

Open the chart page →

5,639
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
simple-git@2.21.0
3.32.0

Open the chart page →

5,946
community-solid-servercommunity-solid-server3.0.01 of 1See more

community-solid-server community-solid-server 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
solidproject/community-server:6.0.2ccc4acb7e9a1
simple-git@3.18.0
3.32.0

Open the chart page →

1,613
activepiecesmeyerchartsVerified publisher0.1.61 of 1See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
activepieces/activepieces:0.23.0c26188b44e62
simple-git@3.21.0
3.32.0

Open the chart page →

2,635
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
simple-git@3.16.0
3.32.0

Open the chart page →

7,776
magic-mirrorgeek-cookbookVerified publisher4.4.21 of 1See more

magic-mirror geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
simple-git@2.37.0
3.32.0

Open the chart page →

4,405
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
simple-git@3.30.0
3.32.0

Open the chart page →

3,833
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
simple-git@3.22.0
3.32.0

Open the chart page →

32,501
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
simple-git@2.48.0
3.32.0

Open the chart page →

4,455
developer-dashboardcloud-native-toolkit1.4.11 of 1See more

developer-dashboard cloud-native-toolkit 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
simple-git@1.122.0
3.32.0

Open the chart page →

25,456
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
simple-git@2.21.0
3.32.0

Open the chart page →

4,253
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
simple-git@1.92.0
3.32.0

Open the chart page →

57,669
interbtc-hydrainterlay0.1.151 of 4See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
simple-git@2.45.1
3.32.0

Open the chart page →

6,831
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
simple-git@3.17.0
3.32.0

Open the chart page →

5,826
mauticmautic-chartVerified publisher1.0.21 of 3See more

mautic mautic-chart 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
mautic/mautic:7-apacheeb8cc73d97e1
simple-git@3.30.0
3.32.0

Open the chart page →

8,303
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
simple-git@1.132.0
3.32.0

Open the chart page →

3,881
fdi-dotstatsuite-sfs-solrstatcan1.0.21 of 4See more

fdi-dotstatsuite-sfs-solr statcan 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
simple-git@1.132.0
3.32.0

Open the chart page →

6,065
fdi-dotstatsuite-sfs-solr-statefulstatcan1.0.21 of 2See more

fdi-dotstatsuite-sfs-solr-stateful statcan 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
simple-git@1.132.0
3.32.0

Open the chart page →

919
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-28291.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
simple-git@3.30.0
3.32.0

Open the chart page →

5,459

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
requarks/wiki:2:latest68f0d1848261
simple-git@3.30.0
3.32.0
2
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
simple-git@1.132.0
3.32.0
2
activepieces/activepieces:0.23.0c26188b44e62
simple-git@3.21.0
3.32.0
1
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
simple-git@2.37.0
3.32.0
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
simple-git@2.48.0
3.32.0
1
ibmcom/microclimate-portal:latested5505e5c7ec
simple-git@1.92.0
3.32.0
1
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
simple-git@2.45.1
3.32.0
1
mautic/mautic:7-apacheeb8cc73d97e1
simple-git@3.30.0
3.32.0
1
n8nio/n8n:1.86.08b39ed5a2de9
simple-git@3.17.0
3.32.0
1
n8nio/n8n:0.212.0a9195bc499a3
simple-git@3.16.0
3.32.0
1
n8nio/n8n:1.33.1dd171d45102a
simple-git@3.17.0
3.32.0
1
requarks/wiki:canary-2.5.2438b5865a7386c
simple-git@2.21.0
3.32.0
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
simple-git@1.132.0
3.32.0
1
solidproject/community-server:6.0.2ccc4acb7e9a1
simple-git@3.18.0
3.32.0
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
simple-git@3.22.0
3.32.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
simple-git@2.21.0
3.32.0
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
simple-git@1.122.0
3.32.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.