StackRadar

CVE-2026-40181

High

Advisory

Published 3 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.002
11th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
30
deployed by those charts
Fix available
2 of 2
affected packages

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 30 images.

Affected packageAffected versionsFixed inImages
react-routernpm6.7.0, 6.9.0, 6.10.0, 6.13.0+15 more6.30.4, 7.14.130
@remix-run/routernpm1.3.0, 1.4.0, 1.5.0, 1.6.3+8 more1.23.321
OSV records
GHSA-2j2x-hqr9-3h42

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
klusterviewklusterviewVerified publisher0.1.01 of 4See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
kyleslugg/klusterview:latestba8c36dfdfbd
@remix-run/router@1.6.3
react-router@6.13.0
1.23.3
6.30.4

Open the chart page →

3,795
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@remix-run/router@1.15.0
react-router@6.22.0
1.23.3
6.30.4

Open the chart page →

2,654
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.14.1

Open the chart page →

7,949
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.14.1

Open the chart page →

1,152
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
react-router@7.13.0
7.14.1

Open the chart page →

1,044
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4

Open the chart page →

6,873
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@remix-run/router@1.19.1
react-router@6.26.1
1.23.3
6.30.4

Open the chart page →

12,581
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@remix-run/router@1.21.0
react-router@6.28.0
1.23.3
6.30.4
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4

Open the chart page →

18,293
stocksalescluster-deploy0.1.31 of 1See more

stocksales cluster-deploy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
foggbh/stocky:latest8b7a2e5ecf4e
react-router@7.12.0
7.14.1

Open the chart page →

408
containers-security-chartscontainers-security0.1.01 of 7See more

containers-security-charts containers-security 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
coldatom/containers-security-front:latest7c2fbbb41bcf
@remix-run/router@1.3.0
react-router@6.7.0
1.23.3
6.30.4

Open the chart page →

9,146
defactopsdefactops1.0.91 of 2See more

defactops defactops 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
defactops/defactops-ui:1.0.16825cdf9ba706
react-router@6.21.3
6.30.4

Open the chart page →

4,509
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4

Open the chart page →

4,251
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
@remix-run/router@1.13.0
react-router@6.20.0
1.23.3
6.30.4

Open the chart page →

4,650
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
react-router@6.30.1
1.23.3
6.30.4

Open the chart page →

819
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
react-router@6.30.1
1.23.3
6.30.4

Open the chart page →

819
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@remix-run/router@1.15.0
react-router@6.22.0
1.23.3
6.30.4

Open the chart page →

2,950
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4

Open the chart page →

5,769
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
react-router@7.13.0
7.14.1

Open the chart page →

6,012
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
@remix-run/router@1.19.1
react-router@6.26.1
1.23.3
6.30.4

Open the chart page →

11,812
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
sky5367/locust-plugins-grafana:latestd51bf68d4b26
react-router@6.21.3
6.30.4

Open the chart page →

7,510
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
@remix-run/router@1.18.0
react-router@6.25.1
1.23.3
6.30.4

Open the chart page →

887
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
react-router@6.21.3
6.30.4

Open the chart page →

7,309
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@remix-run/router@1.5.0
react-router@6.10.0
1.23.3
6.30.4

Open the chart page →

17,929
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
@remix-run/router@1.7.2
react-router@6.14.2
1.23.3
6.30.4

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
@remix-run/router@1.7.2
react-router@6.14.2
1.23.3
6.30.4

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@remix-run/router@1.4.0
react-router@6.9.0
1.23.3
6.30.4

Open the chart page →

15,187
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4

Open the chart page →

3,271
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4

Open the chart page →

5,497
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-40181.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
react-router@7.13.1
7.14.1

Open the chart page →

3,972

Container images carrying it

30 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
@remix-run/router@1.23.0
react-router@6.30.1
1.23.3
6.30.4
2
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4
1
automatischio/automatisch:0.15.03bace7a12d5f
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4
1
coldatom/containers-security-front:latest7c2fbbb41bcf
@remix-run/router@1.3.0
react-router@6.7.0
1.23.3
6.30.4
1
contane/foreman:0.5.2efb98bdcc4e9
react-router@7.6.0
7.14.1
1
defactops/defactops-ui:1.0.16825cdf9ba706
react-router@6.21.3
6.30.4
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
@remix-run/router@1.13.0
react-router@6.20.0
1.23.3
6.30.4
1
foggbh/stocky:latest8b7a2e5ecf4e
react-router@7.12.0
7.14.1
1
grafana/grafana:10.4.0f9811e4e687f
react-router@6.21.3
6.30.4
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
@remix-run/router@1.5.0
react-router@6.10.0
1.23.3
6.30.4
1
kyleslugg/klusterview:latestba8c36dfdfbd
@remix-run/router@1.6.3
react-router@6.13.0
1.23.3
6.30.4
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4
1
sky5367/locust-plugins-grafana:latestd51bf68d4b26
react-router@6.21.3
6.30.4
1
tensorzero/ui:2026.6.0f2563d54724e
react-router@7.13.1
7.14.1
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
@remix-run/router@1.19.1
react-router@6.26.1
1.23.3
6.30.4
1
vlebediantsev/notes-admin-front:latest007c6670ff48
@remix-run/router@1.7.2
react-router@6.14.2
1.23.3
6.30.4
1
vlebediantsev/notes-project-front:latest945675fd2636
@remix-run/router@1.7.2
react-router@6.14.2
1.23.3
6.30.4
1
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
@remix-run/router@1.4.0
react-router@6.9.0
1.23.3
6.30.4
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
@remix-run/router@1.15.0
react-router@6.22.0
1.23.3
6.30.4
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
@remix-run/router@1.15.0
react-router@6.22.0
1.23.3
6.30.4
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
@remix-run/router@1.21.0
react-router@6.28.0
1.23.3
6.30.4
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
react-router@7.13.0
7.14.1
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@remix-run/router@1.19.2
react-router@6.26.2
1.23.3
6.30.4
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
@remix-run/router@1.19.1
react-router@6.26.1
1.23.3
6.30.4
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
react-router@7.1.1
7.14.1
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
@remix-run/router@1.18.0
react-router@6.25.1
1.23.3
6.30.4
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
react-router@7.13.0
7.14.1
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
@remix-run/router@1.23.0
react-router@6.30.0
1.23.3
6.30.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.