CVE-2026-53550

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,781 indexed, latest versions
Container images: 450; deployed by those charts
Fix available: 1 of 2; affected packages

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Carried by container images the latest versions of 454 of 17,781 indexed charts deploy, on 450 images.

Affected package	Affected versions	Fixed in	Images
js-yamlnpm	1.0.3, 3.5.5, 3.6.1, 3.7.0+11 more	3.15.0, 4.2.0	450
node-js-yamldeb	4.1.0+dfsg+~4.0.5-7	no fix listed	1

OSV records: GHSA-h67p-54hq-rp68 UBUNTU-CVE-2026-53550

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

workadventureworkadventure

1.1.0

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	js-yaml@4.1.0	4.2.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	js-yaml@4.1.0	4.2.0

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

1,752

xkopsxkops

0.1.0

1 of 5 See more

13,677

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	js-yaml@3.14.1	3.15.0

Open the chart page →

9,381

Container images carrying it

450 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
skylenet/ethstats-server :pow-latest	d757cc016198	js-yaml@3.14.1	3.15.0	1
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	js-yaml@3.7.0	3.15.0	1
solidproject/community-server :6.0.2	ccc4acb7e9a1	js-yaml@4.1.0	4.2.0	1
soulou2019/node-server :latest	5e6ecfcc109e	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.26.3	092384dba45d	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	js-yaml@4.1.0	4.2.0	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	js-yaml@4.1.0	4.2.0	1
srini78/nodejswebappeks :latest	5d1cbdc6833a	js-yaml@4.1.0	4.2.0	1
stanfordoval/almond-server :latest	1a63cdccedaf	js-yaml@3.14.1	3.15.0	1
subsquid/hydra-indexer :5.0.0-alpha.37	a7f8b9bad7ee	js-yaml@4.1.0	4.2.0	1
subsquid/substrate-explorer :firesquid	0889a857f192	js-yaml@4.1.0	4.2.0	1
supabase/storage-api :v1.60.4	c8eb9858eafe	js-yaml@4.1.1	4.2.0	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	js-yaml@4.1.0	4.2.0	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	js-yaml@4.1.0	4.2.0	1
temporalio/web :1.14.0	33cfa863d8ce	js-yaml@3.14.0	3.15.0	1
tenureai/tenure :v1.0.28	5f5b222df9a5	js-yaml@3.14.2	3.15.0	1
testhubio/testhub-frontend :on-prem	e86c2db53be8	js-yaml@3.13.1	3.15.0	1
th0th/node-red :4.0.3-debian	d06fa39f7406	js-yaml@4.1.0	4.2.0	1
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	js-yaml@4.1.0	4.2.0	1
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	js-yaml@4.1.0	4.2.0	1
thingsboard/tb-js-executor :3.4.1	13e1eadf8ace	js-yaml@4.1.0	4.2.0	1
thingsboard/tb-web-ui :3.4.1	57f98ed53b3d	js-yaml@4.1.0	4.2.0	1
thingsboard/tb-web-ui :3.6.0	d388378062cc	js-yaml@4.1.0	4.2.0	1
thmmniii/fbs-qcm-frontend :v1.27.1	a347f7f4d144	js-yaml@4.1.0	4.2.0	1
tobirachel/node-project3 :v1	7d9f37154994	js-yaml@4.1.0	4.2.0	1
tooljet/tooljet-ce :v1.18.0	c85a4720e42e	js-yaml@4.1.0	4.2.0	1
treskon/portrait-ui :DEV-latest	e7970783bc8d	js-yaml@4.1.0	4.2.0	1
tundeficky/nodejs-app :v1.0.0	3cf9a9ce54e8	js-yaml@4.1.0	4.2.0	1
ubercadence/web :v3.29.5	8564a5b44a6d	js-yaml@3.7.0	3.15.0	1
unitycatalog/unitycatalog-ui :main-aadc6fc	3a688197b218	js-yaml@3.14.1	3.15.0	1
unleashorg/unleash-enterprise :7.5.0	245aeba40053	js-yaml@4.1.1	4.2.0	1
unleashorg/unleash-proxy :v1.4.8	2538f89e2685	js-yaml@4.1.0	4.2.0	1
unleashorg/unleash-server :7.5.0	9adb37e399ba	js-yaml@4.1.1	4.2.0	1
vabene1111/recipes :1.0.5.2	ec4e9e2905b0	js-yaml@3.14.1	3.15.0	1
vcnngr/pnbackend :latest	eaf44ad0ad1f	js-yaml@3.14.1	3.15.0	1
visualregressiontracker/api :5.0.11	941aeb8c8bf9	js-yaml@3.14.1	3.15.0	1
vlebediantsev/notes-admin-front :latest	007c6670ff48	js-yaml@4.1.0	4.2.0	1
vlebediantsev/notes-project-front :latest	945675fd2636	js-yaml@3.14.1	3.15.0	1
vlebediantsev/registration-ms-front-app-host :latest	54f69d116c50	js-yaml@4.1.0	4.2.0	1
wazuh/wazuh-dashboard :4.11.1	0c58e7b47bb6	js-yaml@3.14.1	3.15.0	1
wazuh/wazuh-dashboard :4.4.1	1787550d2358	js-yaml@3.14.1	3.15.0	1
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	js-yaml@3.14.1	3.15.0	1
wazuh/wazuh-dashboard :4.14.3	91e4f0a7feed	js-yaml@3.14.1	3.15.0	1
wekanteam/wekan :v4.22	68a51f0327df	js-yaml@3.12.0	3.15.0	1
willwill/kube-slack :v4.1.1	d443017aae98	js-yaml@3.12.1	3.15.0	1