StackRadar

CVE-2026-54269

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,781 indexed, latest versions
Container images
119
deployed by those charts
Fix available
2 of 2
affected packages

protobufjs : Schema-derived names can shadow runtime-significant properties

Carried by container images the latest versions of 119 of 17,781 indexed charts deploy, on 119 images.

Affected packageAffected versionsFixed inImages
protobufjsnpm5.0.3, 6.8.6, 6.8.8, 6.8.9+22 more7.6.3, 8.6.0119
protobufjs-clinpm1.1.11.3.31
OSV records
GHSA-f38q-mgvj-vph7

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
protobufjs@7.1.2
7.6.3

Open the chart page →

4,744
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
protobufjs@7.5.4
7.6.3

Open the chart page →

4,684
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
protobufjs@7.0.0
7.6.3

Open the chart page →

5,582
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
protobufjs@7.1.2
7.6.3

Open the chart page →

4,431
k8soketisoketi1.0.11 of 1See more

k8soketi soketi 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
protobufjs@6.11.3
7.6.3

Open the chart page →

2,267
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
protobufjs@7.4.0
7.6.3

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
protobufjs@7.4.0
7.6.3

Open the chart page →

11,100
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
protobufjs@7.5.3
7.6.3

Open the chart page →

1,313
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
protobufjs@6.11.2
7.6.3

Open the chart page →

3,881
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
protobufjs@5.0.3
7.6.3

Open the chart page →

4,967
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
protobufjs@6.8.9
7.6.3

Open the chart page →

3,827
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
supabase/storage-api:latestf6c42a04163d
protobufjs@7.5.6
7.6.3

Open the chart page →

9,556
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
protobufjs@6.11.2
7.6.3

Open the chart page →

3,576
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
protobufjs@6.11.3
7.6.3

Open the chart page →

25,394
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
protobufjs@6.10.2
7.6.3

Open the chart page →

2,838
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
protobufjs@7.5.4
7.6.3

Open the chart page →

3,746
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
protobufjs@6.10.2
7.6.3

Open the chart page →

22,665
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
protobufjs@7.2.5
7.6.3

Open the chart page →

6,285
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2026-54269.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
protobufjs@7.2.4
7.6.3
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
protobufjs@7.2.4
7.6.3
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
protobufjs@7.2.4
7.6.3

Open the chart page →

16,083

Container images carrying it

119 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
protobufjs@7.4.0
7.6.3
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
protobufjs@7.5.3
7.6.3
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
protobufjs@7.5.3
7.6.3
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
protobufjs@7.5.5
7.6.3
1
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
protobufjs@7.4.0
7.6.3
1
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
protobufjs@7.4.0
7.6.3
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
protobufjs@7.5.4
7.6.3
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobufjs@7.4.0
7.6.3
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
protobufjs@7.5.6
7.6.3
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
protobufjs@7.2.6
7.6.3
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
protobufjs@7.2.2
7.6.3
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
protobufjs@7.2.2
7.6.3
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
protobufjs@8.4.0
8.6.0
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
protobufjs@7.3.0
7.6.3
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
protobufjs@7.2.5
7.6.3
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
protobufjs@7.5.3
7.6.3
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
protobufjs@7.2.5
7.6.3
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
protobufjs@6.11.3
7.6.3
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
protobufjs@6.8.9
7.6.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.