StackRadar

CVE-2026-5160

Unscored

Advisory

Published 7 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
70
of 17,781 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 1
affected package

Cross-site Scripting (XSS) in github.com/yuin/goldmark

Carried by container images the latest versions of 70 of 17,781 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
github.com/yuin/goldmarkgolangv1.1.25, v1.2.1, v1.3.5, v1.3.7+19 more1.7.1760
OSV records
GO-2026-5320
Also known as
GHSA-c97m-vxhj-p7j6

Charts affected

70 by stars
ChartLatestAffected imagesRadar Score
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
github.com/yuin/goldmark@v1.7.8
1.7.17

Open the chart page →

2,221
signozsignoz0.141.11 of 5See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
signoz/signoz:v0.141.1c10fa03e103c
github.com/yuin/goldmark@v1.7.16
1.7.17

Open the chart page →

7,568
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
github.com/yuin/goldmark@v1.7.8
1.7.17

Open the chart page →

1,235
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
github.com/yuin/goldmark@v1.7.13
1.7.17

Open the chart page →

2,977
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
github.com/yuin/goldmark@v1.7.0
1.7.17

Open the chart page →

23,228
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/yuin/goldmark@v1.7.13
1.7.17

Open the chart page →

3,997
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/yuin/goldmark@v1.5.4
1.7.17

Open the chart page →

8,722
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
github.com/yuin/goldmark@v1.5.6
1.7.17

Open the chart page →

17,404
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
github.com/yuin/goldmark@v1.5.6
1.7.17

Open the chart page →

3,451
listmonkdeliveryheroVerified publisher0.1.121 of 1See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
github.com/yuin/goldmark@v1.4.1
1.7.17

Open the chart page →

2,537
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
github.com/yuin/goldmark@v1.4.1
1.7.17

Open the chart page →

7,579
kubeviouskubevious1.2.21 of 7See more

kubevious kubevious 1.2.2

1 of the 7 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
kubevious/ui:1.2.16233e84bdd59
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

14,204
soft-servealphani-helm-chartsVerified publisher0.4.01 of 1See more

soft-serve alphani-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
charmcli/soft-serve:v0.4.039523c1a6ba8
github.com/yuin/goldmark@v1.4.4
1.7.17

Open the chart page →

3,119
maintenancecodewithemadVerified publisher0.1.61 of 1See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
library/caddy:2.9-alpineb4e3952384eb
github.com/yuin/goldmark@v1.7.8
1.7.17

Open the chart page →

1,469
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
github.com/yuin/goldmark@v1.4.8
1.7.17

Open the chart page →

2,521
owncastgeek-cookbookVerified publisher3.4.21 of 1See more

owncast geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
gabekangas/owncast:0.0.797461aedb580
github.com/yuin/goldmark@v1.3.5
1.7.17

Open the chart page →

3,167
headscale-uiheadscale-uiVerified publisher0.2.91 of 1See more

headscale-ui headscale-ui 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/yuin/goldmark@v1.7.13
1.7.17

Open the chart page →

1,476
giteakeyporttech0.2.101 of 4See more

gitea keyporttech 0.2.10

1 of the 4 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
gitea/gitea:1.12.485416d6f65fe
github.com/yuin/goldmark@v1.1.25
1.7.17

Open the chart page →

5,408
kubebrowsekubebrowse1.7.01 of 5See more

kubebrowse kubebrowse 1.7.0

1 of the 5 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/browsersec/kubebrowse-frontend:chore-improve-backbd6bea5e487c
github.com/yuin/goldmark@v1.7.13
1.7.17

Open the chart page →

4,141
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.111 of 2See more

ace-installer appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.111 of 2See more

ace-installer-certified appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

3,225
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

2,592
capa-vpc-peering-operatorappscodeVerified publisher2023.12.111 of 1See more

capa-vpc-peering-operator appscode 2023.12.11

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/capa-vpc-peering-operator:v0.0.4b1557553a2b3
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

1,433
gh-ci-webhookappscodeVerified publisher2026.9.111 of 1See more

gh-ci-webhook appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/gh-ci-webhook:v0.0.2036ce246d884e
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

1,240
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

2,527
kubedb-provider-azureappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

2,705
kubedb-provider-gcpappscodeVerified publisher2026.7.101 of 2See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

3,033
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

2,796
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

2,716
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/yuin/goldmark@v1.4.13
1.7.17

Open the chart page →

2,743
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

2,592
offline-license-serverappscodeVerified publisher2026.9.111 of 2See more

offline-license-server appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

1,681
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/yuin/goldmark@v1.7.2
1.7.17

Open the chart page →

37,268
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
github.com/yuin/goldmark@v1.7.16
1.7.17

Open the chart page →

1,677
parrot-mirroremmas-chartsVerified publisher1.0.01 of 1See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/yuin/goldmark@v1.5.5
1.7.17

Open the chart page →

2,237
testnet-homepageethereum-helm-chartsVerified publisher0.2.31 of 1See more

testnet-homepage ethereum-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
skylenet/ethereum-testnet-homepage:latest8698903e379f
github.com/yuin/goldmark@v1.4.4
1.7.17

Open the chart page →

2,681
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/yuin/goldmark@v1.4.8
1.7.17

Open the chart page →

20,933
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
library/caddy:2.2.0-alpine7367adca165f
github.com/yuin/goldmark@v1.2.1
1.7.17

Open the chart page →

7,470
vikunjageek-cookbookVerified publisher6.2.02 of 4See more

vikunja geek-cookbook 6.2.0

2 of the 4 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
library/caddy:2.4.2-alpinefbc51bcf1ab0
github.com/yuin/goldmark@v1.3.7
1.7.17
vikunja/api:0.17.18cba0520bf8c
github.com/yuin/goldmark@v1.3.5
1.7.17

Open the chart page →

6,893
webhook-receivergeek-cookbookVerified publisher0.0.11 of 1See more

webhook-receiver geek-cookbook 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/geek-cookbook/webhook-receiver:2.8.172e7e77f8091
github.com/yuin/goldmark@v1.5.2
1.7.17

Open the chart page →

1,362
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
github.com/yuin/goldmark@v1.5.6
1.7.17

Open the chart page →

3,451
listmonkhelm-charts-nr0.1.121 of 1See more

listmonk helm-charts-nr 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
github.com/yuin/goldmark@v1.4.1
1.7.17

Open the chart page →

2,537
answerhelmforgeVerified publisher1.5.21 of 1See more

answer helmforge 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
apache/answer:2.0.2a0d71b0e30a5
github.com/yuin/goldmark@v1.7.4
1.7.17

Open the chart page →

556
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
github.com/yuin/goldmark@v1.7.16
1.7.17

Open the chart page →

9,342
discount-bandithelmforgeVerified publisher2.0.81 of 3See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/yuin/goldmark@v1.7.13
1.7.17

Open the chart page →

29,817
listmonkhelmforgeVerified publisher1.1.141 of 3See more

listmonk helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
listmonk/listmonk:v6.2.0f535d59e1499
github.com/yuin/goldmark@v1.7.12
1.7.17

Open the chart page →

2,839
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/yuin/goldmark@v1.7.8
1.7.17

Open the chart page →

6,012
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-5160.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
github.com/yuin/goldmark@v1.5.6
1.7.17

Open the chart page →

3,614

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kubiyabot/agent-manager:v0.4.13757bdd779345
github.com/yuin/goldmark@v1.7.8
1.7.17
1
ghcr.io/kubiyabot/workflow-engine:v1.46.2560a16a56d4e
github.com/yuin/goldmark@v1.7.8
1.7.17
1
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/yuin/goldmark@v1.7.1
1.7.17
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/yuin/goldmark@v1.5.5
1.7.17
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/yuin/goldmark@v1.5.4
1.7.17
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
github.com/yuin/goldmark@v1.4.8
1.7.17
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/yuin/goldmark@v1.7.13
1.7.17
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/yuin/goldmark@v1.5.5
1.7.17
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/yuin/goldmark@v1.7.13
1.7.17
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
github.com/yuin/goldmark@v1.7.13
1.7.17
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.