StackRadar

CVE-2026-35209

High

Advisory

Published 4 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
20
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

defu: Prototype pollution via `__proto__` key in defaults argument

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
defunpm2.0.2, 4.0.1, 5.0.0, 5.0.1+3 more6.1.524
OSV records
GHSA-737v-mqg7-c878

Charts affected

20 by stars
ChartLatestAffected imagesRadar Score
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
defu@6.1.4
6.1.5

Open the chart page →

2,581
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
defu@5.0.1
6.1.5

Open the chart page →

17,404
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
defu@4.0.1
6.1.5

Open the chart page →

7,579
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
defu@6.1.2
6.1.5
ghcr.io/data-fair/metrics:0a8d40779eeae
defu@5.0.0
6.1.5
ghcr.io/data-fair/notify:3c739b74dabb0
defu@5.0.1
6.1.5
ghcr.io/data-fair/portals:18b621866ceb2
defu@5.0.1
6.1.5
ghcr.io/data-fair/processings:15a9216989707
defu@6.1.3
6.1.5
ghcr.io/data-fair/simple-directory:438a4f32fad82
defu@4.0.1
6.1.5

Open the chart page →

38,346
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
defu@6.1.4
6.1.5

Open the chart page →

32,501
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
defu@6.1.4
6.1.5

Open the chart page →

2,538
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
defu@2.0.2
6.1.5

Open the chart page →

3,651
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
defu@6.1.2
6.1.5

Open the chart page →

4,560
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
defu@6.1.4
6.1.5

Open the chart page →

4,016
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
defu@6.1.4
6.1.5

Open the chart page →

3,798
wireguardnicklasfrahm-wireguard0.2.01 of 1See more

wireguard nicklasfrahm-wireguard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:145f26407fd2ed
defu@6.1.4
6.1.5

Open the chart page →

1,157
elkrivals-spaceVerified publisher0.1.11 of 1See more

elk rivals-space 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/elk-zone/elk:main046dfdb8550c
defu@6.1.4
6.1.5

Open the chart page →

276
wg-easyrm3lVerified publisher0.2.01 of 1See more

wg-easy rm3l 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:145f26407fd2ed
defu@6.1.4
6.1.5

Open the chart page →

1,157
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
defu@6.1.4
6.1.5

Open the chart page →

5,819
s3-browsers3-browser0.4.11 of 1See more

s3-browser s3-browser 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
defu@6.1.4
6.1.5

Open the chart page →

576
elk-frontendschoenwald0.2.221 of 1See more

elk-frontend schoenwald 0.2.22

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
defu@6.1.4
6.1.5

Open the chart page →

387
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
defu@6.1.4
6.1.5

Open the chart page →

15,635
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
defu@6.1.4
6.1.5

Open the chart page →

3,746
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
defu@6.1.4
6.1.5

Open the chart page →

2,789
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-35209.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
defu@6.1.4
6.1.5

Open the chart page →

5,984

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/wg-easy/wg-easy:145f26407fd2ed
defu@6.1.4
6.1.5
2
baserow/baserow:1.30.1df0c42eb67e8
defu@5.0.1
6.1.5
1
evoapicloud/evolution-api:latest966625532d90
defu@6.1.4
6.1.5
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
defu@4.0.1
6.1.5
1
lavandadelpatio/frontend:latest501c3f31e0bc
defu@2.0.2
6.1.5
1
moonrailgun/tianji:1.11.2b528c8f8fcc4
defu@6.1.2
6.1.5
1
sigp/siren:v3.0.42c219b04758e
defu@6.1.4
6.1.5
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
defu@6.1.4
6.1.5
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
defu@6.1.4
6.1.5
1
ghcr.io/ajnart/homarr:lateste103abadfb52
defu@6.1.4
6.1.5
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
defu@6.1.4
6.1.5
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
defu@6.1.4
6.1.5
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
defu@6.1.2
6.1.5
1
ghcr.io/data-fair/metrics:0a8d40779eeae
defu@5.0.0
6.1.5
1
ghcr.io/data-fair/notify:3c739b74dabb0
defu@5.0.1
6.1.5
1
ghcr.io/data-fair/portals:18b621866ceb2
defu@5.0.1
6.1.5
1
ghcr.io/data-fair/processings:15a9216989707
defu@6.1.3
6.1.5
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
defu@4.0.1
6.1.5
1
ghcr.io/elk-zone/elk:main046dfdb8550c
defu@6.1.4
6.1.5
1
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
defu@6.1.4
6.1.5
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
defu@6.1.4
6.1.5
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
defu@6.1.4
6.1.5
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
defu@6.1.4
6.1.5
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
defu@6.1.4
6.1.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.