StackRadar

CVE-2026-45623

High

Advisory

Published 23 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
241
of 17,781 indexed, latest versions
Container images
241
deployed by those charts
Fix available
1 of 2
affected packages

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Carried by container images the latest versions of 241 of 17,781 indexed charts deploy, on 241 images.

Affected packageAffected versionsFixed inImages
postcssnpm4.1.16, 5.2.18, 6.0.17, 6.0.22+48 more8.5.12241
node-postcssdeb8.4.31+~cs8.0.26-1no fix listed1
OSV records
GHSA-6g55-p6wh-862qUBUNTU-CVE-2026-45623

Charts affected

241 by stars
ChartLatestAffected imagesRadar Score
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
postcss@8.4.31
8.5.12

Open the chart page →

5,338
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
postcss@8.4.24
8.5.12

Open the chart page →

7,413
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
postcss@8.5.6
8.5.12

Open the chart page →

5,819
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
postcss@8.5.6
8.5.12

Open the chart page →

4,684
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
postcss@8.4.21
8.5.12

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
postcss@7.0.35
8.5.12

Open the chart page →

3,638
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
postcss@8.4.38
8.5.12

Open the chart page →

5,497
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
postcss@8.4.31
8.5.12

Open the chart page →

1,991
dashysergiotocaliniVerified publisher1.0.01 of 1See more

dashy sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
postcss@7.0.39
8.5.12

Open the chart page →

3,143
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/ondrejsika/counter-frontend:latestc4166d2eb8eb
postcss@8.4.14
8.5.12

Open the chart page →

4,820
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
postcss@7.0.21
8.5.12

Open the chart page →

3,696
sneakerssneakers1.0.01 of 4See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
helga09/shoes_ukr:v1.1.17999bc8b77c0
postcss@8.4.23
8.5.12

Open the chart page →

7,574
speedtest-trackersoblivionscall3.0.41 of 1See more

speedtest-tracker soblivionscall 3.0.4

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
henrywhitaker3/speedtest-tracker:latest47159a940229
postcss@6.0.23
8.5.12

Open the chart page →

2,460
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
postcss@8.4.31
8.5.12

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
postcss@8.4.31
8.5.12

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
postcss@8.4.31
8.5.12

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
postcss@8.4.31
8.5.12

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
postcss@8.4.31
8.5.12

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
postcss@8.4.31
8.5.12

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
postcss@8.4.31
8.5.12

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
postcss@8.4.31
8.5.12

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
postcss@8.4.31
8.5.12

Open the chart page →

11,100
nordmart-reviewstakaterVerified publisher0.0.61 of 3See more

nordmart-review stakater 0.0.6

1 of the 3 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
postcss@8.3.0
8.5.12

Open the chart page →

11,554
nordmart-review-instancestakaterVerified publisher1.0.01 of 3See more

nordmart-review-instance stakater 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
postcss@8.3.0
8.5.12

Open the chart page →

11,554
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
postcss@8.4.39
8.5.12

Open the chart page →

4,052
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
postcss@6.0.23
8.5.12

Open the chart page →

3,881
slack-emoji-makersuminhong0.1.01 of 1See more

slack-emoji-maker suminhong 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
postcss@8.5.3
8.5.12

Open the chart page →

1,653
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
postcss@8.4.6
8.5.12

Open the chart page →

4,017
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
postcss@8.5.10
8.5.12

Open the chart page →

3,972
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
postcss@8.4.47
8.5.12

Open the chart page →

28,814
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
postcss@8.4.47
8.5.12

Open the chart page →

28,385
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
postcss@8.4.47
8.5.12

Open the chart page →

28,858
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
postcss@7.0.39
8.5.12

Open the chart page →

20,270
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
pysga1996/python-redis-web:latestfdeec30ad482
postcss@7.0.35
8.5.12

Open the chart page →

4,661
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
postcss@8.4.31
8.5.12
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
postcss@8.4.31
8.5.12
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
postcss@8.4.31
8.5.12

Open the chart page →

6,994
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
postcss@8.5.1
8.5.12

Open the chart page →

5,228
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
postcss@8.4.31
8.5.12

Open the chart page →

2,789
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss@8.4.31
8.5.12

Open the chart page →

5,984
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
postcss@6.0.23
8.5.12

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
postcss@6.0.23
8.5.12

Open the chart page →

22,665
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-45623.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
postcss@8.4.31
8.5.12
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
postcss@8.4.31
8.5.12
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
postcss@8.4.31
8.5.12

Open the chart page →

16,083

Container images carrying it

241 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
drumsergio/lynxprompt:2.0.75c6afb6679301
postcss@8.4.31
8.5.12
1
dserio83/velero-ui:0.3.1b4e1ec6664d3
postcss@8.4.31
8.5.12
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
postcss@8.4.14
8.5.12
1
ethersphere/onboarding-faucet:0.3.0513154aab230
postcss@8.4.5
8.5.12
1
ethpandaops/blobscan:latest7a9ab6370657
postcss@8.4.14
8.5.12
1
ethpandaops/ethereumjs:masterfb84b718500f
postcss@8.5.6
8.5.12
1
factly/mande-web:0.34.1742355964b0e
postcss@8.4.14
8.5.12
1
fallenbagel/jellyseerr:latest4538137bc5af
postcss@8.4.31
8.5.12
1
fallenbagel/jellyseerr:1.7.06dcdb5ba5091
postcss@8.4.14
8.5.12
1
felipecs8/conversor-temperatura:v1f945423be36d
postcss@8.5.8
8.5.12
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
postcss@6.0.22
8.5.12
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
postcss@8.4.31
8.5.12
1
fosrl/pangolin:1.13.0c32ad797ab96
postcss@8.4.31
8.5.12
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
postcss@7.0.39
8.5.12
1
helga09/shoes_ukr:v1.1.17999bc8b77c0
postcss@8.4.23
8.5.12
1
henrywhitaker3/speedtest-tracker:latest47159a940229
postcss@6.0.23
8.5.12
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
postcss@7.0.39
8.5.12
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
postcss@8.5.3
8.5.12
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
postcss@8.4.47
8.5.12
1
ibarreche/cloud-front-ci:latestc8970ac1c8dc
postcss@7.0.5
8.5.12
1
ibmcom/app-nav-ui:1.0.1e2a86997b36b
postcss@6.0.23
8.5.12
1
ibmcom/microclimate-portal:latested5505e5c7ec
postcss@6.0.17
8.5.12
1
instill/console:0.68.54cd70e2df5c6
postcss@8.5.6
8.5.12
1
jayfong/yapi:1.10.2163e5d621910
postcss@5.2.18
8.5.12
1
joplin/server:3.0-beta52af57880c0e
postcss@8.4.24
8.5.12
1
joplin/server:2.14.2-betab87564ef34e9
postcss@8.4.31
8.5.12
1
jupyterhub/jupyterhub:5.4.63974ba945e65
node-postcss@8.4.31+~cs8.0.26-1
postcss@8.4.31
no fix listed
8.5.12
1
keyoxide/keyoxide:stable96f27a71269d
postcss@8.4.11
8.5.12
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
postcss@7.0.39
8.5.12
1
konradkleine/docker-registry-frontend:v2181aad54ee64
postcss@4.1.16
8.5.12
1
kyleslugg/klusterview:latestba8c36dfdfbd
postcss@8.4.24
8.5.12
1
kyso/kyso-front:lateste52595c5c16f
postcss@8.4.30
8.5.12
1
langgenius/dify-web:0.6.11a2a294743634
postcss@8.4.31
8.5.12
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
postcss@8.4.31
8.5.12
1
langgenius/dify-web:1.0.0d64914ff0d6d
postcss@8.4.31
8.5.12
1
lavandadelpatio/frontend:latest501c3f31e0bc
postcss@7.0.30
8.5.12
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
postcss@8.4.38
8.5.12
1
library/ghost:6.37.01ef2e532ca4d
postcss@8.5.6
8.5.12
1
library/ghost:6.25.12654b1e90413
postcss@8.5.6
8.5.12
1
library/ghost:6.41.129773d6be407
postcss@8.5.6
8.5.12
1
library/ghost:4.37.0767230c0f263
postcss@8.4.6
8.5.12
1
library/ghost:6.39.0-alpine77196da4b0df
postcss@8.5.6
8.5.12
1
library/ghost:5.79.083f7bf209844
postcss@8.4.33
8.5.12
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
postcss@8.5.6
8.5.12
1
linuxserver/calibre:version-v5.21.0a847b5b2d860
postcss@7.0.36
8.5.12
1
linuxserver/codimd:latestb801bbcf6386
postcss@7.0.35
8.5.12
1
linuxserver/overseerr:1.35.06108ed066d4a
postcss@8.4.14
8.5.12
1
lissy93/dashy:2.0.51991f7be5ed0
postcss@7.0.39
8.5.12
1
lobehub/lobe-chat:1.96.9da0c21fefcd3
postcss@8.4.31
8.5.12
1
louislam/uptime-kuma:1.17.1a4eab252e5a2
postcss@8.4.14
8.5.12
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.