StackRadarChart IndexLive demo

CVE-2026-30838

Medium

Advisory

Published 6 Mar 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.1; base score, highest
EPSS: 0.002; 12th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 1 of 1; affected package

CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
league/commonmarkcomposer	2.2.1, 2.3.0, 2.3.3, 2.3.4+6 more	2.8.1	20

OSV records: GHSA-4v6x-c7xx-hw9f

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

1 of 2 See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
snipe/snipe-it :v6.0.14	55fb7636a98c	league/commonmark@2.3.4	2.8.1

Open the chart page →

18,509

monicamonica

1 of 1 See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
ghcr.io/monicahq/monica-next :main	8be69156acbb	league/commonmark@2.7.1	2.8.1

Open the chart page →

5,634

bookstackgabe565

1 of 1 See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/bookstack :version-v24.12.1	cc795b254b73	league/commonmark@2.6.1	2.8.1

Open the chart page →

2,811

invoiceninjainvoiceninja

1 of 5 See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
invoiceninja/invoiceninja :5.6.24	1437916dee01	league/commonmark@2.4.0	2.8.1

Open the chart page →

2,709

akauntingf3k-tech

1 of 4 See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
akaunting/akaunting :3.1.21-fpm-alpine-nginx	e7d5c245b1a0	league/commonmark@2.8.0	2.8.1

Open the chart page →

4,333

firefly-iiigeek-cookbook

1 of 1 See more

firefly-iii geek-cookbook 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
fireflyiii/core :version-5.6.14	2f4283bd0cf7	league/commonmark@2.2.1	2.8.1

Open the chart page →

2,076

monicageek-cookbook

1 of 1 See more

monica geek-cookbook 8.2.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
library/monica :3.7.0-apache	ceb1ba4196ab	league/commonmark@2.2.1	2.8.1

Open the chart page →

2,096

leantimegissilabs

1 of 2 See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
leantime/leantime :3.3.3	ad4bfb0699d3	league/commonmark@2.5.3	2.8.1

Open the chart page →

6,416

1 of 3 See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
castopod/castopod :1.12.10	1fd37280cbb2	league/commonmark@2.5.3	2.8.1

Open the chart page →

10,072

linkstackadnoctem

1 of 1 See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
linkstackorg/linkstack :latest	1c8b05399ee4	league/commonmark@2.8.0	2.8.1

Open the chart page →

2,092

heimdallegeback

1 of 1 See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
linuxserver/heimdall :2.6.3	71597f4461e4	league/commonmark@2.4.2	2.8.1

Open the chart page →

1,664

supportpalevilgn0me

1 of 1 See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	league/commonmark@2.3.0	2.8.1

Open the chart page →

20,933

monicagabe565

1 of 2 See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
library/monica :4.1.2-fpm-alpine	6d1b2bd0947e	league/commonmark@2.4.2	2.8.1

Open the chart page →

1,173

anonaddygeek-cookbook

1 of 1 See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
anonaddy/anonaddy :0.12.3	957a95565166	league/commonmark@2.3.3	2.8.1

Open the chart page →

4,788

castopodhelmforge

1 of 3 See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
castopod/castopod :1.15.5	4e4f0440520f	league/commonmark@2.8.0	2.8.1

Open the chart page →

9,342

akauntingnas-helm-charts

1 of 2 See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
akaunting/akaunting :3.0.15	52811b36ec3a	league/commonmark@2.4.0	2.8.1

Open the chart page →

12,813

librenmsnimbolus

1 of 3 See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
librenms/librenms :24.11.0	0920bc9117a8	league/commonmark@2.5.3	2.8.1

Open the chart page →

2,293

firefly-iiiphntom

1 of 2 See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
phntom/fireflyiii :version-5.7.5	f881ea5fbbf1	league/commonmark@2.3.0	2.8.1

Open the chart page →

1,813

snipeitschmitzis

1 of 2 See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
snipe/snipe-it :v8.3.1	141ebf2386fe	league/commonmark@2.7.1	2.8.1

Open the chart page →

6,094

apiwbstack

1 of 1 See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-30838.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/api :8x.9.11	eee94f9f7a53	league/commonmark@2.3.3	2.8.1

Open the chart page →

2,019

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
akaunting/akaunting :3.0.15	52811b36ec3a	league/commonmark@2.4.0	2.8.1	1
akaunting/akaunting :3.1.21-fpm-alpine-nginx	e7d5c245b1a0	league/commonmark@2.8.0	2.8.1	1
anonaddy/anonaddy :0.12.3	957a95565166	league/commonmark@2.3.3	2.8.1	1
castopod/castopod :1.12.10	1fd37280cbb2	league/commonmark@2.5.3	2.8.1	1
castopod/castopod :1.15.5	4e4f0440520f	league/commonmark@2.8.0	2.8.1	1
fireflyiii/core :version-5.6.14	2f4283bd0cf7	league/commonmark@2.2.1	2.8.1	1
invoiceninja/invoiceninja :5.6.24	1437916dee01	league/commonmark@2.4.0	2.8.1	1
leantime/leantime :3.3.3	ad4bfb0699d3	league/commonmark@2.5.3	2.8.1	1
library/monica :4.1.2-fpm-alpine	6d1b2bd0947e	league/commonmark@2.4.2	2.8.1	1
library/monica :3.7.0-apache	ceb1ba4196ab	league/commonmark@2.2.1	2.8.1	1
librenms/librenms :24.11.0	0920bc9117a8	league/commonmark@2.5.3	2.8.1	1
linkstackorg/linkstack :latest	1c8b05399ee4	league/commonmark@2.8.0	2.8.1	1
linuxserver/heimdall :2.6.3	71597f4461e4	league/commonmark@2.4.2	2.8.1	1
phntom/fireflyiii :version-5.7.5	f881ea5fbbf1	league/commonmark@2.3.0	2.8.1	1
snipe/snipe-it :v8.3.1	141ebf2386fe	league/commonmark@2.7.1	2.8.1	1
snipe/snipe-it :v6.0.14	55fb7636a98c	league/commonmark@2.3.4	2.8.1	1
ghcr.io/linuxserver/bookstack :version-v24.12.1	cc795b254b73	league/commonmark@2.6.1	2.8.1	1
ghcr.io/monicahq/monica-next :main	8be69156acbb	league/commonmark@2.7.1	2.8.1	1
ghcr.io/wbstack/api :8x.9.11	eee94f9f7a53	league/commonmark@2.3.3	2.8.1	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	league/commonmark@2.3.0	2.8.1	1