StackRadar

CVE-2026-41650

Medium

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.002
15th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
121
of 17,781 indexed, latest versions
Container images
118
deployed by those charts
Fix available
1 of 1
affected package

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Carried by container images the latest versions of 121 of 17,781 indexed charts deploy, on 118 images.

Affected packageAffected versionsFixed inImages
fast-xml-parsernpm3.19.0, 3.21.1, 4.0.11, 4.1.2+20 more5.7.0118
OSV records
GHSA-gh4j-gqv2-49f6

Charts affected

121 by stars
ChartLatestAffected imagesRadar Score
blobscanethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ethpandaops/blobscan:latest7a9ab6370657
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

1,329
blobscan-indexerethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan-indexer ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ethpandaops/blobscan-indexer:latestc58eb9ffe446
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

2,114
uptime-kumafluent-operatorVerified publisher0.1.01 of 1See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:13d632903e6af
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

3,474
shinobigeek-cookbookVerified publisher1.2.21 of 1See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
shinobisystems/shinobi:dev3ca746937856
fast-xml-parser@3.19.0
5.7.0

Open the chart page →

4,591
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

4,259
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

9,019
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
fast-xml-parser@5.0.9
5.7.0

Open the chart page →

2,950
lobe-chathelm-charts-darox0.1.561 of 1See more

lobe-chat helm-charts-darox 0.1.56

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
lobehub/lobe-chat:1.96.9da0c21fefcd3
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

666
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
fast-xml-parser@4.5.0
5.7.0

Open the chart page →

5,769
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
fast-xml-parser@4.3.6
5.7.0

Open the chart page →

18,813
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

1,271
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

5,826
image-storage-servicejtektVerified publisher0.4.31 of 4See more

image-storage-service jtekt 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

22,589
shinsei-managerjtektVerified publisher0.2.01 of 8See more

shinsei-manager jtekt 0.2.0

1 of the 8 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

63,461
k10appk10app0.2.11 of 11See more

k10app k10app 0.2.1

1 of the 11 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/k10app/catalog:latest639c980be0f1
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

10,546
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
fast-xml-parser@3.19.0
5.7.0

Open the chart page →

4,667
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.7.0

Open the chart page →

5,228
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

9,098
pangolinkrzwiatrzyk0.11.01 of 1See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
fosrl/pangolin:1.13.0c32ad797ab96
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

3,441
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
fast-xml-parser@3.19.0
5.7.0

Open the chart page →

5,410
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

1,378
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
fast-xml-parser@4.5.6
5.7.0

Open the chart page →

2,548
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

6,356
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

3,555
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

33,242
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

9,774
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

9,668
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

43,341
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

2,457
finance-portalmojaloop5.1.42 of 11See more

finance-portal mojaloop 5.1.4

2 of the 11 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
fast-xml-parser@4.5.3
5.7.0
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

14,809
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

2,631
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

2,318
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
fast-xml-parser@4.5.3
5.7.0

Open the chart page →

2,457
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/mongo-express:latest1b23d7976f02
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

5,179
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
moreillon/camera-proxy:latestce60056b50c2
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

11,643
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

4,960
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
neoskop/papergirl:3.2.67f52b5949f03
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

6,982
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

2,383
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
fast-xml-parser@4.5.0
5.7.0

Open the chart page →

4,219
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

1,811
prismeai-coreprismeai1.12.11 of 7See more

prismeai-core prismeai 1.12.1

1 of the 7 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
fast-xml-parser@4.5.7
5.7.0

Open the chart page →

3,270
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

4,600
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
fast-xml-parser@5.5.9
5.7.0

Open the chart page →

68,240
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
fast-xml-parser@4.4.1
5.7.0

Open the chart page →

5,338
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
fast-xml-parser@4.1.2
5.7.0

Open the chart page →

7,413
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.7.0

Open the chart page →

5,819
s3-browsers3-browser0.4.11 of 1See more

s3-browser s3-browser 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
fast-xml-parser@5.5.8
5.7.0

Open the chart page →

576
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
library/mongo-express:1.0.2-20-alpine3.191aae00775251
fast-xml-parser@4.0.11
5.7.0

Open the chart page →

2,309
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-41650.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
fast-xml-parser@4.2.5
5.7.0

Open the chart page →

4,744

Container images carrying it

118 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
fast-xml-parser@5.2.1
5.7.0
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
fast-xml-parser@4.5.6
5.7.0
1
ghcr.io/shuguet/pacman:latesta0ec71732c3c
fast-xml-parser@5.5.8
5.7.0
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
fast-xml-parser@4.1.2
5.7.0
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
fast-xml-parser@5.2.5
5.7.0
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
fast-xml-parser@4.5.3
5.7.0
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
fast-xml-parser@4.2.5
5.7.0
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
fast-xml-parser@4.2.5
5.7.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
fast-xml-parser@4.2.5
5.7.0
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
fast-xml-parser@4.2.5
5.7.0
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
fast-xml-parser@5.6.0
5.7.0
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
fast-xml-parser@4.0.11
5.7.0
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
fast-xml-parser@5.5.8
5.7.0
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
fast-xml-parser@4.5.7
5.7.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.