StackRadarChart IndexLive demo

CVE-2026-44665

Medium

Advisory

Published 8 May 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.002; 11th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 14; deployed by those charts
Fix available: 1 of 1; affected package

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 14 images.

Affected package	Affected versions	Fixed in	Images
fast-xml-buildernpm	1.0.0, 1.1.4, 1.1.5	1.1.7	14

OSV records: GHSA-5wm8-gmm8-39j9

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

backstagerhdh-chart

1 of 2 See more

backstage rhdh-chart 4.0.1

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

1,339

karakeephelmforge

1 of 3 See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.33.2	b069e4307dec	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

9,460

pacmanpacman

1 of 2 See more

pacman pacman 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
ghcr.io/shuguet/pacman :latest	a0ec71732c3c	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

638

nocodbzekker6

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

4,016

rocketadminrocketadmin

1 of 1 See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
rocketadmin/rocketadmin :1.17.7	10955ef540b9	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

5,482

wikiwenerme

1 of 2 See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
requarks/wiki :latest	68f0d1848261	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

3,833

adeptia-automate-mcpadeptia-automate-mcp

1 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

3,600

cloudvaultcloudvault

1 of 3 See more

cloudvault cloudvault 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
shyamkrishna21/cloudvault :latest	af2785f5bb71	fast-xml-builder@1.0.0	1.1.7

Open the chart page →

2,184

devtron-enterprisedevtron

1 of 28 See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

68,240

devtron-enterprisedevtron-labs

1 of 28 See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

68,240

hedgedocernail-hedgedoc

1 of 1 See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

1,755

genieacsgenieacs

1 of 2 See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
drumsergio/genieacs :1.2.16.0	28244054e1bf	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

4,259

uptime-kumakubernetes-homelab-helm-charts

1 of 1 See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.2.1-slim	059b49d64739	fast-xml-builder@1.0.0	1.1.7

Open the chart page →

6,356

uptime-kumalbenicio-community

1 of 1 See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

33,242

uptime-kumaloeken-at-home

1 of 1 See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

33,242

devtron-enterpriseromholdings

1 of 28 See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

68,240

colanodevictorlane

1 of 3 See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
ghcr.io/colanode/server :latest	7006cac874fd	fast-xml-builder@1.1.4	1.1.7

Open the chart page →

2,076

wikiwikijs

1 of 2 See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-44665.

Container image	Digest	Package	Fixed in
requarks/wiki :2	68f0d1848261	fast-xml-builder@1.1.5	1.1.7

Open the chart page →

5,459

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	fast-xml-builder@1.1.4	1.1.7	3
louislam/uptime-kuma :2.3.2	9aeb4e51d038	fast-xml-builder@1.1.5	1.1.7	2
requarks/wiki :2 :latest	68f0d1848261	fast-xml-builder@1.1.5	1.1.7	2
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	fast-xml-builder@1.1.4	1.1.7	1
drumsergio/genieacs :1.2.16.0	28244054e1bf	fast-xml-builder@1.1.4	1.1.7	1
louislam/uptime-kuma :2.2.1-slim	059b49d64739	fast-xml-builder@1.0.0	1.1.7	1
nocodb/nocodb :0.301.5	d9516f0bf546	fast-xml-builder@1.1.4	1.1.7	1
rocketadmin/rocketadmin :1.17.7	10955ef540b9	fast-xml-builder@1.1.5	1.1.7	1
shyamkrishna21/cloudvault :latest	af2785f5bb71	fast-xml-builder@1.0.0	1.1.7	1
ghcr.io/colanode/server :latest	7006cac874fd	fast-xml-builder@1.1.4	1.1.7	1
ghcr.io/karakeep-app/karakeep :0.33.2	b069e4307dec	fast-xml-builder@1.1.4	1.1.7	1
ghcr.io/shuguet/pacman :latest	a0ec71732c3c	fast-xml-builder@1.1.5	1.1.7	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	fast-xml-builder@1.1.4	1.1.7	1
quay.io/rhdh/rhdh-hub-rhel9 :latest	0b26358f5793	fast-xml-builder@1.1.5	1.1.7	1