StackRadar

CVE-2026-41650

Medium

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
121
of 17,781 indexed, latest versions
Container images
118
deployed by those charts
Fix available
1 of 1
affected package

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Carried by container images the latest versions of 121 of 17,781 indexed charts deploy, on 118 images.

Affected packageAffected versionsFixed inImages
fast-xml-parsernpm3.19.0, 3.21.1, 4.0.11, 4.1.2+20 more5.7.0118
OSV records
GHSA-gh4j-gqv2-49f6

Charts affected

121 by stars
ChartLatestAffected imagesRadar Score
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

1,210
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

5,352
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
supabase/storage-api:v1.12.0f983fb50bd95
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

23,123
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
budibase/apps:3.41.344fe6feab985
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

10,775
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
fast-xml-parser@4.3.5
5.7.0

Open the chart page →

5,639
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-director:2.5.1110228ecd353b
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

4,285
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
fast-xml-parser@3.19.0
5.7.0

Open the chart page →

5,251
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

9,460
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

2,654
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
fast-xml-parser@4.2.5
5.7.0
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

28,839
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

7,776
pacmanpacmanVerified publisher2.0.21 of 2See more

pacman pacman 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/shuguet/pacman:latesta0ec71732c3c
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

638
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
fast-xml-parser@5.4.1
5.7.0

Open the chart page →

4,016
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/data-fair/notify:3c739b74dabb0
fast-xml-parser@4.5.3
5.7.0
ghcr.io/data-fair/processings:15a9216989707
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

38,346
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
fast-xml-parser@4.1.2
5.7.0

Open the chart page →

3,925
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

11,458
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
fast-xml-parser@3.19.0
5.7.0

Open the chart page →

4,260
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

4,196
kenerkenerVerified publisher0.2.01 of 1See more

kener kener 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
fast-xml-parser@5.2.1
5.7.0

Open the chart page →

5,228
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
fast-xml-parser@4.5.7
5.7.0

Open the chart page →

1,322
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
chibisafe/chibisafe-server:latest3da4fcbc1a18
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

5,654
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

13,738
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

2,473
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

6,873
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

6,883
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
fast-xml-parser@5.3.6
5.7.0

Open the chart page →

7,035
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

5,482
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

2,823
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

38,107
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

5,213
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

10,380
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

3,600
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

1,055
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

3,820
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
fast-xml-parser@3.21.1
5.7.0

Open the chart page →

523
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
fast-xml-parser@4.4.0
5.7.0

Open the chart page →

3,437
bluesky-pdsbear0.4.2081 of 1See more

bluesky-pds bear 0.4.208

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
fast-xml-parser@5.3.4
5.7.0

Open the chart page →

2,136
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

4,455
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

4,083
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
fast-xml-parser@4.3.6
5.7.0
countly/frontend:25.05.42acbc11499b6
fast-xml-parser@4.3.6
5.7.0

Open the chart page →

7,295
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
fast-xml-parser@4.4.1
5.7.0
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
fast-xml-parser@5.2.5
5.7.0
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

18,293
cloudvaultcloudvaultOfficialVerified publisher1.0.21 of 3See more

cloudvault cloudvault 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
shyamkrishna21/cloudvault:latestaf2785f5bb71
fast-xml-parser@5.4.2
5.7.0

Open the chart page →

2,184
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
fast-xml-parser@3.21.1
5.7.0

Open the chart page →

5,488
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

3,769
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
fast-xml-parser@5.5.9
5.7.0

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
fast-xml-parser@5.5.9
5.7.0

Open the chart page →

68,240
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

4,551
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

4,217
documensodocumensoVerified publisher0.0.61 of 2See more

documenso documenso 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
documenso/documenso:v1.8.17f16a9449f18
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

2,862
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
fast-xml-parser@5.6.0
5.7.0

Open the chart page →

1,755

Container images carrying it

118 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.7.0
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
fast-xml-parser@4.5.6
5.7.0
1
ghcr.io/shuguet/pacman:latesta0ec71732c3c
fast-xml-parser@5.5.8
5.7.0
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
fast-xml-parser@4.1.2
5.7.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
fast-xml-parser@4.5.3
5.7.0
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-xml-parser@4.2.5
5.7.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
fast-xml-parser@4.2.5
5.7.0
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
fast-xml-parser@4.2.5
5.7.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
fast-xml-parser@5.6.0
5.7.0
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
fast-xml-parser@4.0.11
5.7.0
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
fast-xml-parser@5.5.8
5.7.0
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
fast-xml-parser@4.5.7
5.7.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.