StackRadar

CVE-2026-39356

High

Advisory

Published 8 Apr 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
9
of 17,781 indexed, latest versions
Container images
10
deployed by those charts
Fix available
1 of 1
affected package

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

Carried by container images the latest versions of 9 of 17,781 indexed charts deploy, on 10 images.

Affected packageAffected versionsFixed inImages
drizzle-ormnpm0.28.6, 0.33.0, 0.35.3, 0.44.2+3 more0.45.210
OSV records
GHSA-gpj5-g38j-94v9

Charts affected

9 by stars
ChartLatestAffected imagesRadar Score
homarroben01Verified publisher1.4.01 of 1See more

homarr oben01 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
drizzle-orm@0.28.6
0.45.2

Open the chart page →

2,581
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
drizzle-orm@0.33.0
0.45.2

Open the chart page →

9,460
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
drizzle-orm@0.35.3
0.45.2

Open the chart page →

28,839
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
drizzle-orm@0.44.2
0.45.2

Open the chart page →

5,213
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
drizzle-orm@0.44.5
0.45.2
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
drizzle-orm@0.44.5
0.45.2

Open the chart page →

18,293
self-learning-platformhelm-self-learning-platformVerified publisher1.1.01 of 1See more

self-learning-platform helm-self-learning-platform 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
devopsiaci/self-learning-platform:1.1.3d9441c931f75
drizzle-orm@0.45.1
0.45.2

Open the chart page →

1,468
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
drizzle-orm@0.45.0
0.45.2

Open the chart page →

3,441
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
drizzle-orm@0.44.2
0.45.2

Open the chart page →

5,338
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39356.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
drizzle-orm@0.28.6
0.45.2

Open the chart page →

2,789

Container images carrying it

10 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
devopsiaci/self-learning-platform:1.1.3d9441c931f75
drizzle-orm@0.45.1
0.45.2
1
fosrl/pangolin:1.13.0c32ad797ab96
drizzle-orm@0.45.0
0.45.2
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
drizzle-orm@0.28.6
0.45.2
1
ghcr.io/ajnart/homarr:lateste103abadfb52
drizzle-orm@0.28.6
0.45.2
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
drizzle-orm@0.44.5
0.45.2
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
drizzle-orm@0.44.5
0.45.2
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
drizzle-orm@0.44.2
0.45.2
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
drizzle-orm@0.33.0
0.45.2
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
drizzle-orm@0.44.2
0.45.2
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
drizzle-orm@0.35.3
0.45.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.