CVE-2026-53550

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 32nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 454; of 17,787 indexed, latest versions
Container images: 450; deployed by those charts
Fix available: 1 of 2; affected packages

JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Carried by container images the latest versions of 454 of 17,787 indexed charts deploy, on 450 images.

Affected package	Affected versions	Fixed in	Images
js-yamlnpm	1.0.3, 3.5.5, 3.6.1, 3.7.0+11 more	3.15.0, 4.2.0	450
node-js-yamldeb	4.1.0+dfsg+~4.0.5-7	no fix listed	1

OSV records: GHSA-h67p-54hq-rp68 UBUNTU-CVE-2026-53550

Charts affected

454 by stars

Chart

Latest

Affected images

Radar Score

workadventureworkadventure

1.1.0

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	js-yaml@4.1.0	4.2.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	js-yaml@4.1.0	4.2.0

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

1,752

xkopsxkops

0.1.0

1 of 5 See more

13,677

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-53550.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	js-yaml@3.14.1	3.15.0

Open the chart page →

9,381

Container images carrying it

450 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/linuxserver/raneto :version-0.16.6	ef768f3df5d0	js-yaml@3.14.1	3.15.0	1
ghcr.io/linuxserver/wikijs :version-2.5.201	58d377933678	js-yaml@3.13.1	3.15.0	1
ghcr.io/m9sweeper/dash :1.6.0	2e27cdff8344	js-yaml@4.1.0	4.2.0	1
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	js-yaml@4.1.0	4.2.0	1
ghcr.io/manzil-infinity180/frontend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	4e6394b715d9	js-yaml@4.1.0	4.2.0	1
ghcr.io/mario-f/kubevis :v1.4.0	763daf9caf8e	js-yaml@3.14.1	3.15.0	1
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	js-yaml@3.14.1	3.15.0	1
ghcr.io/mcwarman/backstage-sample-app/backend :main	07aba09a594f	js-yaml@3.14.1	3.15.0	1
ghcr.io/middleware-labs/odigos-ui :middleware-test-0.0.7	87120a4561a9	js-yaml@4.1.0	4.2.0	1
ghcr.io/middleware-labs/vision-ui :middleware-test-0.0.8	53772b7b42c7	js-yaml@4.1.0	4.2.0	1
ghcr.io/open-telemetry/demo :1.12.0-frontend	8b348f00ca4c	js-yaml@4.1.0	4.2.0	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	js-yaml@4.1.0	4.2.0	1
ghcr.io/papra-hq/papra :26.6.2-rootless	a281cb44176d	js-yaml@3.14.1	3.15.0	1
ghcr.io/rajnandan1/kener :3.2.18	2b993cb232eb	js-yaml@4.1.0	4.2.0	1
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	js-yaml@3.14.1	3.15.0	1
ghcr.io/rodg/nodecg-base :latest	31be4bf87070	js-yaml@4.1.0	4.2.0	1
ghcr.io/rybbit-io/rybbit-backend :latest	e0d1b397e33c	js-yaml@4.1.1	4.2.0	1
ghcr.io/sct/overseerr :1.26.1	254d16af8f71	js-yaml@4.0.0	4.2.0	1
ghcr.io/sct/overseerr :1.35.0	6197516c9d7b	js-yaml@4.1.0	4.2.0	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	js-yaml@3.14.1	3.15.0	1
ghcr.io/seerr-team/seerr :v3.2.0	c4cbd5121236	js-yaml@3.14.2	3.15.0	1
ghcr.io/tale/headplane :0.5.5	0dbc52cffc19	js-yaml@4.1.0	4.2.0	1
ghcr.io/vincenttaglia/indexer-tools :v3.4.4	5bae30456ddb	js-yaml@4.1.0	4.2.0	1
ghcr.io/waldo-vision/migrate :v0.3.6	ae31923312ed	js-yaml@4.1.0	4.2.0	1
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	js-yaml@4.0.0	4.2.0	1
ghcr.io/wei-shaw/claude-relay-service :v1.1.292	398c34934453	js-yaml@4.1.0	4.2.0	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	js-yaml@4.1.0	4.2.0	1
ghcr.io/woodenmaiden/relfinderreformedapi :1.1.2	0708d30433d4	js-yaml@3.14.1	3.15.0	1
ghcr.io/wundergraph/cosmo/controlplane :0.133.1	49800ff775f3	js-yaml@4.1.0	4.2.0	1
ghcr.io/zazuko/trifid :v6.0.1	59bda2bf65d4	js-yaml@3.14.2	3.15.0	1
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	js-yaml@4.1.0	4.2.0	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	js-yaml@3.14.1	3.15.0	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	js-yaml@3.14.1	3.15.0	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	js-yaml@3.14.1	3.15.0	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	js-yaml@4.1.0	4.2.0	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	js-yaml@4.1.0	4.2.0	1
quay.io/flomesh/flomesh-console-ubi8 :0.70.0-30	ce6938ff6709	js-yaml@4.1.0	4.2.0	1
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	js-yaml@4.1.1	4.2.0	1
quay.io/helmpack/monocular-ui :v1.10.0	86b71e90319f	js-yaml@3.9.1	3.15.0	1
quay.io/ibmgaragecloud/developer-dashboard :v1.4.4	7a4b9fedc724	js-yaml@3.13.1	3.15.0	1
quay.io/mittwald/kube-mail :latest	04f1099241fc	js-yaml@4.1.0	4.2.0	1
quay.io/mongodb/farm-intro-frontend :0.1	99ccdfd543e1	js-yaml@3.14.0	3.15.0	1
quay.io/seamware/onboarding :0.2.2	b406475f9f00	js-yaml@4.1.1	4.2.0	1
quay.io/soketi/k8soketi :0.1-18-debian	4cd9ea9434c4	js-yaml@4.1.0	4.2.0	1
quay.io/soketi/pws :0.8-16-alpine	399d2e6b10ef	js-yaml@3.14.1	3.15.0	1
quay.io/wekan/wekan :v5.65	cb17600883a3	js-yaml@3.14.1	3.15.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	js-yaml@3.14.2	3.15.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	js-yaml@4.1.0	4.2.0	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	js-yaml@4.1.1	4.2.0	1
registry.gitlab.com/xrow-public/helm-iframely/iframely :2.3.5	fcf07d5ff7e2	js-yaml@4.1.0	4.2.0	1