CVE-2026-53550

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,787 indexed, latest versions
Container images: 450; deployed by those charts
Fix available: 1 of 2; affected packages

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Carried by container images the latest versions of 454 of 17,787 indexed charts deploy, on 450 images.

Affected package	Affected versions	Fixed in	Images
js-yamlnpm	1.0.3, 3.5.5, 3.6.1, 3.7.0+11 more	3.15.0, 4.2.0	450
node-js-yamldeb	4.1.0+dfsg+~4.0.5-7	no fix listed	1

OSV records: GHSA-h67p-54hq-rp68 UBUNTU-CVE-2026-53550

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

workadventureworkadventure

1.1.0

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	js-yaml@4.1.0	4.2.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	js-yaml@4.1.0	4.2.0

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

1,752

xkopsxkops

0.1.0

1 of 5 See more

13,677

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	js-yaml@3.14.1	3.15.0

Open the chart page →

9,381

Container images carrying it

450 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
winfred008/amazon :9	10a68de5b398	js-yaml@4.1.0	4.2.0	1
wiremind/scrapoxy :latest	e7048929a676	js-yaml@3.13.1	3.15.0	1
xom4ekp2p/infini-route-attestators-public-mainnet-attester :latest	d0e0aa238b02	js-yaml@4.1.0	4.2.0	1
ymuski/skooner :latest	67819ca511b5	js-yaml@4.1.0	4.2.0	1
yuzutech/kroki-bpmn :0.29.1	444805c4b917	js-yaml@4.1.1	4.2.0	1
yuzutech/kroki-diagramsnet :0.29.1	b810edbf9c62	js-yaml@4.1.1	4.2.0	1
yuzutech/kroki-excalidraw :0.29.1	57917319ea70	js-yaml@4.1.1	4.2.0	1
yuzutech/kroki-mermaid :0.29.1	963b4acfde6e	js-yaml@4.1.1	4.2.0	1
zazuko/trifid :2.3.7	054be137de70	js-yaml@3.14.1	3.15.0	1
zooz/predator :1.6	f491d1f7a865	js-yaml@3.13.1	3.15.0	1
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	js-yaml@3.14.1	3.15.0	1
zwavejs/zwave-js-ui :11.22.3	14d018bb689e	js-yaml@4.1.1	4.2.0	1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	js-yaml@4.1.1	4.2.0	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	js-yaml@4.1.0	4.2.0	1
ghcr.io/blessingnator/keycloak-mcn-backend :2.0.5	967470f05472	js-yaml@4.1.1	4.2.0	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	js-yaml@4.1.1	4.2.0	1
ghcr.io/bryopsida/openmct :main	38b6a50a62b2	js-yaml@4.1.0	4.2.0	1
ghcr.io/bryopsida/patchwork :main	c01e018bced4	js-yaml@4.1.0	4.2.0	1
ghcr.io/bryopsida/psa-restricted-patcher :main	a53ef16b024a	js-yaml@4.1.0	4.2.0	1
ghcr.io/bryopsida/syslog-portal :main	3947bfd04f49	js-yaml@3.14.1	3.15.0	1
ghcr.io/clastix/kamaji-console :v0.2.1	29ecf8d4fa65	js-yaml@4.1.0	4.2.0	1
ghcr.io/colanode/server :latest	7006cac874fd	js-yaml@4.1.1	4.2.0	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	js-yaml@4.1.0	4.2.0	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	js-yaml@3.14.1	3.15.0	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	js-yaml@3.14.0	3.15.0	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	js-yaml@3.14.0	3.15.0	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	js-yaml@3.14.0	3.15.0	1
ghcr.io/curium-rocks/k8s-jacoco-operator :main	a558ceae6cdb	js-yaml@4.1.0	4.2.0	1
ghcr.io/curium-rocks/k8s-mutating-webhook :main	aaab005242ae	js-yaml@4.1.0	4.2.0	1
ghcr.io/curium-rocks/k8s-validating-webhook :main	8344061b2f22	js-yaml@4.1.0	4.2.0	1
ghcr.io/curium-rocks/kube-admission-controller-starter :main	e9716966f30b	js-yaml@4.1.0	4.2.0	1
ghcr.io/danny-avila/librechat :v0.7.8	7fe76551a78e	js-yaml@4.1.0	4.2.0	1
ghcr.io/danny-avila/librechat :v0.7.7	8c68abbe1cff	js-yaml@4.1.0	4.2.0	1
ghcr.io/data-fair/data-fair :3	cc9498b64b5b	js-yaml@3.14.1	3.15.0	1
ghcr.io/data-fair/metrics :0	a8d40779eeae	js-yaml@3.14.1	3.15.0	1
ghcr.io/data-fair/notify :3	c739b74dabb0	js-yaml@3.14.1	3.15.0	1
ghcr.io/data-fair/processings :1	5a9216989707	js-yaml@3.14.1	3.15.0	1
ghcr.io/data-fair/simple-directory :4	38a4f32fad82	js-yaml@3.14.1	3.15.0	1
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	js-yaml@3.13.1	3.15.0	1
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	js-yaml@4.1.0	4.2.0	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	js-yaml@4.1.0	4.2.0	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	js-yaml@4.1.0	4.2.0	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	js-yaml@4.1.0	4.2.0	1
ghcr.io/gethomepage/homepage :v1.13.1	d8d784e50901	js-yaml@4.1.1	4.2.0	1
ghcr.io/hiteshnayak305/cors-proxy :1.2.0	e6ff0a131556	js-yaml@4.1.0	4.2.0	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	js-yaml@4.1.0	4.2.0	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	js-yaml@4.1.0	4.2.0	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	js-yaml@3.14.0	3.15.0	1
ghcr.io/leoquote/mergeable :latest	451706815103	js-yaml@3.14.0	3.15.0	1
ghcr.io/leprechaun/lgtv2mqtt :latest	ac2e11c41ffb	js-yaml@4.1.0	4.2.0	1