StackRadar

CVE-2026-33170

Medium

Advisory

Published 23 Mar 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 17,781 indexed, latest versions
Container images
34
deployed by those charts
Fix available
1 of 1
affected package

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Carried by container images the latest versions of 30 of 17,781 indexed charts deploy, on 34 images.

Affected packageAffected versionsFixed inImages
activesupportgem4.2.10, 4.2.11.1, 5.2.0, 5.2.1+18 more7.2.3.1, 8.1.2.134
OSV records
GHSA-89vf-4333-qx8v

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
activesupport@7.1.5.2
7.2.3.1

Open the chart page →

9,203
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
activesupport@6.1.5
7.2.3.1

Open the chart page →

19,337
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
activesupport@6.0.3.1
7.2.3.1

Open the chart page →

18,137
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
activesupport@6.1.7.2
7.2.3.1

Open the chart page →

5,056
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
activesupport@5.2.4.6
7.2.3.1

Open the chart page →

6,110
docker-registry-browsergmelilloVerified publisher0.1.21 of 1See more

docker-registry-browser gmelillo 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.3.5430a440d95af
activesupport@6.0.3.4
7.2.3.1

Open the chart page →

4,108
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
activesupport@6.1.4.1
7.2.3.1

Open the chart page →

6,810
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
activesupport@4.2.11.1
7.2.3.1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
activesupport@4.2.11.1
7.2.3.1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
activesupport@4.2.11.1
7.2.3.1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
activesupport@4.2.11.1
7.2.3.1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
activesupport@4.2.11.1
7.2.3.1

Open the chart page →

113,791
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
activesupport@7.0.8
7.2.3.1

Open the chart page →

5,940
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
activesupport@7.2.3
7.2.3.1

Open the chart page →

7,527
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
activesupport@7.0.8.7
7.2.3.1

Open the chart page →

5,558
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
activesupport@8.1.2
8.1.2.1

Open the chart page →

2,766
honeywell-exporterbryanalves0.1.11 of 1See more

honeywell-exporter bryanalves 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
activesupport@5.2.0
7.2.3.1

Open the chart page →

5,437
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
activesupport@7.2.3
7.2.3.1

Open the chart page →

14,130
fluentd-cloudwatchcloudnativeapp0.9.01 of 2See more

fluentd-cloudwatch cloudnativeapp 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
activesupport@5.2.2
7.2.3.1

Open the chart page →

1,342
puppet-forgecloudnativeapp0.1.81 of 2See more

puppet-forge cloudnativeapp 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
hickey/puppet_forge:1.10.0c1148a09ef20
activesupport@4.2.10
7.2.3.1

Open the chart page →

4,086
fluentd-kubernetes-awscloudposse0.2.11 of 2See more

fluentd-kubernetes-aws cloudposse 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
activesupport@5.2.3
7.2.3.1

Open the chart page →

1,305
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
activesupport@6.1.4.1
7.2.3.1

Open the chart page →

3,564
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
activesupport@8.1.1
8.1.2.1

Open the chart page →

3,255
fluentd-elasticsearchkfirfer13.9.11 of 1See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
activesupport@7.0.4
7.2.3.1

Open the chart page →

1,178
gitlabkubesphereVerified publisher4.2.34 of 17See more

gitlab kubesphere 4.2.3

4 of the 17 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
activesupport@6.0.3.1
7.2.3.1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
activesupport@6.0.3.1
7.2.3.1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
activesupport@6.0.3.1
7.2.3.1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
activesupport@6.0.3.1
7.2.3.1

Open the chart page →

38,133
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
activesupport@7.0.8
7.2.3.1

Open the chart page →

5,940
fluentd-papertrailmozilla0.2.21 of 1See more

fluentd-papertrail mozilla 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
activesupport@5.2.1
7.2.3.1

Open the chart page →

1,001
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
activesupport@7.0.3
7.2.3.1

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
activesupport@7.0.3
7.2.3.1

Open the chart page →

12,791
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
activesupport@5.2.4.6
7.2.3.1

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
activesupport@5.2.4.6
7.2.3.1

Open the chart page →

14,154
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
activesupport@6.1.7.2
7.2.3.1

Open the chart page →

6,026
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
activesupport@7.0.7.2
7.2.3.1

Open the chart page →

1,955
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-33170.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
activesupport@7.2.2.1
7.2.3.1

Open the chart page →

10,795

Container images carrying it

34 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chatwoot/chatwoot:v3.1.0d530ab8c1753
activesupport@7.0.8
7.2.3.1
2
pecan/bety:5.4.1f825d480cd62
activesupport@5.2.4.6
7.2.3.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
activesupport@7.0.3
7.2.3.1
2
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
activesupport@5.2.0
7.2.3.1
1
chatwoot/chatwoot:v4.15.167ebc751c171
activesupport@7.1.5.2
7.2.3.1
1
docuseal/docuseal:2.4.17493fd7f6728
activesupport@8.1.2
8.1.2.1
1
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
activesupport@5.2.2
7.2.3.1
1
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
activesupport@5.2.1
7.2.3.1
1
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
activesupport@5.2.3
7.2.3.1
1
hickey/puppet_forge:1.10.0c1148a09ef20
activesupport@4.2.10
7.2.3.1
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
activesupport@6.0.3.1
7.2.3.1
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
activesupport@6.0.3.4
7.2.3.1
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
activesupport@6.1.4.1
7.2.3.1
1
library/redmine:6.1.204ac44a2595b
activesupport@7.2.3
7.2.3.1
1
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
activesupport@6.0.3.1
7.2.3.1
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
activesupport@6.0.3.1
7.2.3.1
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
activesupport@6.0.3.1
7.2.3.1
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
activesupport@6.0.3.1
7.2.3.1
1
octoboxio/octobox:latestd909041c46eb
activesupport@8.1.1
8.1.2.1
1
openproject/community:12.0.2734743d11094
activesupport@6.1.4.1
7.2.3.1
1
uffizzi/app:latest66e9e3937c60
activesupport@6.1.5
7.2.3.1
1
vmware/kube-fluentd-operator:latestf028c138a5f4
activesupport@7.0.7.2
7.2.3.1
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
activesupport@5.2.4.6
7.2.3.1
1
ghcr.io/caninehq/canine:latesta058034ca006
activesupport@7.2.3
7.2.3.1
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
activesupport@7.0.8.7
7.2.3.1
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
activesupport@4.2.11.1
7.2.3.1
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
activesupport@4.2.11.1
7.2.3.1
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
activesupport@4.2.11.1
7.2.3.1
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
activesupport@4.2.11.1
7.2.3.1
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
activesupport@4.2.11.1
7.2.3.1
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
activesupport@6.1.7.2
7.2.3.1
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
activesupport@7.2.2.1
7.2.3.1
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
activesupport@6.1.7.2
7.2.3.1
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
activesupport@7.0.4
7.2.3.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.