CVE-2026-5160
UnscoredAdvisory
Published 7 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 21st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 70
- of 17,781 indexed, latest versions
- Container images
- 60
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Cross-site Scripting (XSS) in github.com/yuin/goldmark
Carried by container images the latest versions of 70 of 17,781 indexed charts deploy, on 60 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v1.1.25, v1.2.1, v1.3.5, v1.3.7+19 more | 1.7.17 | 60 |
- OSV records
- GO-2026-5320
- Also known as
- GHSA-c97m-vxhj-p7j6
Charts affected
70 by stars
Container images carrying it
60 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 76d28575b71c | github.com/ | 1.7.17 | 7 |
| vikunja/ | ed1f3ed467fe | github.com/ | 1.7.17 | 3 |
| hoppscotch/ | f1da831950b7 | github.com/ | 1.7.17 | 2 |
| listmonk/ | d2eac77ddfad | github.com/ | 1.7.17 | 2 |
| listmonk/ | f535d59e1499 | github.com/ | 1.7.17 | 2 |
| mattermost/ | b8bd1246cb3a | github.com/ | 1.7.17 | 2 |
| apache/ | a0d71b0e30a5 | github.com/ | 1.7.17 | 1 |
| baserow/ | df0c42eb67e8 | github.com/ | 1.7.17 | 1 |
| castopod/ | 4e4f0440520f | github.com/ | 1.7.17 | 1 |
| charmcli/ | 39523c1a6ba8 | github.com/ | 1.7.17 | 1 |
| cybrarist/ | e9e2447ac666 | github.com/ | 1.7.17 | 1 |
| gabekangas/ | 97461aedb580 | github.com/ | 1.7.17 | 1 |
| gboxproxy/ | 3a9f4a711d5c | github.com/ | 1.7.17 | 1 |
| gitea/ | 76f516a1a8c2 | github.com/ | 1.7.17 | 1 |
| gitea/ | 85416d6f65fe | github.com/ | 1.7.17 | 1 |
| gitea/ | ac73e0da341f | github.com/ | 1.7.17 | 1 |
| gitea/ | d5ab14cd29af | github.com/ | 1.7.17 | 1 |
| hkotel/ | 3c04c0e85039 | github.com/ | 1.7.17 | 1 |
| hoppscotch/ | 538fe6ded4b6 | github.com/ | 1.7.17 | 1 |
| kubevious/ | 6233e84bdd59 | github.com/ | 1.7.17 | 1 |
| kvalitetsit/ | f57e7553f5bd | github.com/ | 1.7.17 | 1 |
| library/ | 60fb54d36b4b | github.com/ | 1.7.17 | 1 |
| library/ | 7367adca165f | github.com/ | 1.7.17 | 1 |
| library/ | 834468128c76 | github.com/ | 1.7.17 | 1 |
| library/ | 874405536b3e | github.com/ | 1.7.17 | 1 |
| library/ | b4e3952384eb | github.com/ | 1.7.17 | 1 |
| library/ | fbc51bcf1ab0 | github.com/ | 1.7.17 | 1 |
| listmonk/ | bf3903d54a46 | github.com/ | 1.7.17 | 1 |
| neosmemo/ | 3eefcc231141 | github.com/ | 1.7.17 | 1 |
| phntom/ | 51cf9da4aa2e | github.com/ | 1.7.17 | 1 |
| semaphoreui/ | 3996804607eb | github.com/ | 1.7.17 | 1 |
| semaphoreui/ | 98ad9bc7a2a0 | github.com/ | 1.7.17 | 1 |
| semaphoreui/ | e9260bfa8255 | github.com/ | 1.7.17 | 1 |
| signoz/ | c10fa03e103c | github.com/ | 1.7.17 | 1 |
| skylenet/ | 8698903e379f | github.com/ | 1.7.17 | 1 |
| tykio/ | 92509e00e618 | github.com/ | 1.7.17 | 1 |
| vikunja/ | 8cba0520bf8c | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | b1557553a2b3 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | 36ce246d884e | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | e4b66308d8f6 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | bd6bea5e487c | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | 72e7e77f8091 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | 015f5ba04bcb | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | a752b6aee537 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | 49b1c312e342 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | aa0c8526ae5e | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | a1d4cf8b8fe1 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | e3d1f1302e49 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | ac8459f70f85 | github.com/ | 1.7.17 | 1 |
| ghcr.io/ | af77073c184f | github.com/ | 1.7.17 | 1 |