StackRadar

CVE-2026-29063

Critical

Advisory

Published 4 Mar 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
76
of 17,781 indexed, latest versions
Container images
66
deployed by those charts
Fix available
1 of 1
affected package

Immutable is vulnerable to Prototype Pollution

Carried by container images the latest versions of 76 of 17,781 indexed charts deploy, on 66 images.

Affected packageAffected versionsFixed inImages
immutablenpm3.7.6, 3.8.2, 4.0.0, 4.0.0-rc.14+12 more3.8.3, 4.3.8, 5.1.566
OSV records
GHSA-wf6x-7x77-mvgw

Charts affected

76 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
immutable@5.1.4
5.1.5

Open the chart page →

19,391
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
immutable@4.3.7
4.3.8

Open the chart page →

7,210
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
supabase/studio:20241021-9f9b08326d8070c55e9
immutable@4.3.4
4.3.8

Open the chart page →

23,123
krokicowboysysopVerified publisher6.1.01 of 5See more

kroki cowboysysop 6.1.0

1 of the 5 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
yuzutech/kroki-excalidraw:0.29.157917319ea70
immutable@4.3.7
4.3.8

Open the chart page →

6,743
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
immutable@4.3.4
4.3.8

Open the chart page →

2,581
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
immutable@4.3.4
4.3.8

Open the chart page →

17,245
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
immutable@4.0.0
4.3.8

Open the chart page →

5,251
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
immutable@3.7.6
3.8.3

Open the chart page →

5,946
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
immutable@4.3.0
4.3.8

Open the chart page →

3,795
open5gsopen5gsVerified publisher2.3.41 of 5See more

open5gs open5gs 2.3.4

1 of the 5 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
immutable@4.3.4
4.3.8

Open the chart page →

9,261
community-solid-servercommunity-solid-server3.0.01 of 1See more

community-solid-server community-solid-server 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
solidproject/community-server:6.0.2ccc4acb7e9a1
immutable@4.1.0
4.3.8

Open the chart page →

1,613
graphql-hivegraphql-hive1.0.01 of 17See more

graphql-hive graphql-hive 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
immutable@3.7.6
3.8.3

Open the chart page →

10,311
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
kobotoolbox/kpi:2.022.24dbcacc01bccd4
immutable@3.8.2
3.8.3

Open the chart page →

18,517
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
immutable@4.2.4
4.3.8

Open the chart page →

5,056
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
immutable@4.0.0
4.3.8

Open the chart page →

3,925
dashykrzwiatrzyk1.0.01 of 1See more

dashy krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
immutable@4.1.0
4.3.8

Open the chart page →

3,143
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
immutable@4.3.0
4.3.8

Open the chart page →

20,403
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
immutable@4.3.4
4.3.8

Open the chart page →

5,300
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
immutable@5.1.2
5.1.5

Open the chart page →

5,213
ackeesudaVerified publisher0.2.11 of 1See more

ackee suda 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
electerious/ackee:3.2.05e7173fa321c
immutable@3.7.6
3.8.3

Open the chart page →

1,602
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
immutable@4.3.7
4.3.8

Open the chart page →

12,581
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
immutable@3.7.6
3.8.3

Open the chart page →

3,833
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
immutable@3.8.2
3.8.3

Open the chart page →

25,443
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
assistiot/open_api_frontend:1.0.1f11d82defc70
immutable@3.8.2
3.8.3

Open the chart page →

18,277
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
immutable@4.3.5
4.3.8

Open the chart page →

32,501
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
immutable@4.3.7
4.3.8

Open the chart page →

14,130
chatgpt-next-webchatgpt-next-web0.1.11 of 1See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
immutable@4.3.0
4.3.8

Open the chart page →

1,977
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
immutable@4.3.0
4.3.8
countly/frontend:25.05.42acbc11499b6
immutable@4.3.0
4.3.8

Open the chart page →

7,295
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
immutable@4.3.2
4.3.8

Open the chart page →

1,924
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
langgenius/dify-web:1.0.0d64914ff0d6d
immutable@4.3.7
4.3.8

Open the chart page →

19,224
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
immutable@4.3.7
4.3.8

Open the chart page →

4,551
bee-localchainethersphereVerified publisher0.2.01 of 1See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
immutable@4.3.5
4.3.8

Open the chart page →

2,266
bzz-token-serviceethersphereVerified publisher0.2.01 of 1See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ethersphere/bzz-token-service:latest7624f11a72ad
immutable@4.0.0-rc.14
4.3.8

Open the chart page →

3,260
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ethersphere/bee-localchain:latest0558799ca992
immutable@4.3.5
4.3.8

Open the chart page →

4,756
onboarding-faucetethersphereVerified publisher0.2.01 of 1See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ethersphere/onboarding-faucet:0.3.0513154aab230
immutable@4.0.0
4.3.8

Open the chart page →

3,320
mandefactlyVerified publisher0.5.161 of 3See more

mande factly 0.5.16

1 of the 3 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
factly/mande-web:0.34.1742355964b0e
immutable@4.3.4
4.3.8

Open the chart page →

4,777
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
immutable@4.3.0
4.3.8

Open the chart page →

3,159
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
immutable@3.7.6
3.8.3

Open the chart page →

2,682
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
immutable@3.7.6
3.8.3

Open the chart page →

2,682
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
immutable@4.3.0
4.3.8

Open the chart page →

18,813
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
immutable@3.7.6
3.8.3

Open the chart page →

4,253
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
immutable@4.3.4
4.3.8

Open the chart page →

3,407
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ibmcom/microclimate-portal:latested5505e5c7ec
immutable@3.8.2
3.8.3

Open the chart page →

57,669
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
immutable@4.3.7
4.3.8

Open the chart page →

11,812
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
immutable@4.0.0-rc.14
4.3.8

Open the chart page →

4,944
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
immutable@3.8.2
3.8.3

Open the chart page →

6,454
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
immutable@4.0.0
4.3.8

Open the chart page →

4,230
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
immutable@3.8.2
3.8.3

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
immutable@3.8.2
3.8.3

Open the chart page →

11,695
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-29063.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
immutable@3.8.2
3.8.3

Open the chart page →

12,108

Container images carrying it

66 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
immutable@3.8.2
3.8.3
3
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
immutable@3.7.6
3.8.3
3
ethersphere/bee-localchain:latest0558799ca992
immutable@4.3.5
4.3.8
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
immutable@4.3.6
4.3.8
2
gradiant/open5gs-webui:2.7.5fbd10c017541
immutable@4.3.4
4.3.8
2
mojaloop/central-ledger:v13.14.01abc8a7aa71c
immutable@3.8.2
3.8.3
2
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
immutable@3.8.2
3.8.3
2
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
immutable@5.1.3
5.1.5
2
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
immutable@5.1.3
5.1.5
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
immutable@4.3.4
4.3.8
2
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
immutable@5.1.4
5.1.5
2
requarks/wiki:2:latest68f0d1848261
immutable@3.7.6
3.8.3
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
immutable@4.1.0
4.3.8
2
0hlov3/semaphore:v1.0.050f874ec096b
immutable@4.1.0
4.3.8
1
assistiot/open_api_frontend:1.0.1f11d82defc70
immutable@3.8.2
3.8.3
1
countly/api:25.05.4f4cc7447c4f5
immutable@4.3.0
4.3.8
1
countly/countly-server:25.05.4e3c238248f99
immutable@4.3.0
4.3.8
1
countly/frontend:25.05.42acbc11499b6
immutable@4.3.0
4.3.8
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
immutable@4.3.7
4.3.8
1
directus/directus:11.1.0e3c8bb975350
immutable@4.3.7
4.3.8
1
electerious/ackee:3.2.05e7173fa321c
immutable@3.7.6
3.8.3
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
immutable@4.0.0-rc.14
4.3.8
1
ethersphere/bzz-token-service:latest7624f11a72ad
immutable@4.0.0-rc.14
4.3.8
1
ethersphere/onboarding-faucet:0.3.0513154aab230
immutable@4.0.0
4.3.8
1
factly/mande-web:0.34.1742355964b0e
immutable@4.3.4
4.3.8
1
fiware/idm:8.3.3a1b6ed4ae84f
immutable@4.3.0
4.3.8
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
immutable@4.3.0
4.3.8
1
ibmcom/microclimate-portal:latested5505e5c7ec
immutable@3.8.2
3.8.3
1
jayfong/yapi:1.10.2163e5d621910
immutable@3.8.2
3.8.3
1
joplin/server:3.0-beta52af57880c0e
immutable@4.0.0
4.3.8
1
joplin/server:2.14.2-betab87564ef34e9
immutable@4.0.0
4.3.8
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
immutable@3.8.2
3.8.3
1
kyleslugg/klusterview:latestba8c36dfdfbd
immutable@4.3.0
4.3.8
1
langgenius/dify-web:0.6.11a2a294743634
immutable@4.3.0
4.3.8
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
immutable@5.1.4
5.1.5
1
langgenius/dify-web:1.0.0d64914ff0d6d
immutable@4.3.7
4.3.8
1
lissy93/dashy:2.0.51991f7be5ed0
immutable@4.0.0
4.3.8
1
misskey/misskey:12.110.1e08b7c478093
immutable@4.0.0
4.3.8
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
immutable@4.0.0
4.3.8
1
opea/codegen-ui:1.02bee4eb66f3e
immutable@4.3.7
4.3.8
1
openmined/syft-frontend:0.9.5d11524a3854a
immutable@4.3.4
4.3.8
1
polonel/trudesk:1.2.60cf6513f6fe3
immutable@4.1.0
4.3.8
1
requarks/wiki:canary-2.5.2438b5865a7386c
immutable@3.7.6
3.8.3
1
solidproject/community-server:6.0.2ccc4acb7e9a1
immutable@4.1.0
4.3.8
1
supabase/studio:20241021-9f9b08326d8070c55e9
immutable@4.3.4
4.3.8
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
immutable@4.2.1
4.3.8
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
immutable@4.3.7
4.3.8
1
vlebediantsev/notes-project-front:latest945675fd2636
immutable@4.3.2
4.3.8
1
yidadaa/chatgpt-next-web:latesteaaa469ddeeb
immutable@4.3.0
4.3.8
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
immutable@4.3.7
4.3.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.