StackRadarChart IndexLive demo

CVE-2026-55180

Medium

Advisory

Published 26 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 35; of 17,781 indexed, latest versions
Container images: 36; deployed by those charts
Fix available: 1 of 1; affected package

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 36 images.

Affected package	Affected versions	Fixed in	Images
pnpmnpm	7.28.0, 8.3.1, 8.10.2, 8.15.1+21 more	10.34.2, 11.5.3	36

OSV records: GHSA-3qhv-2rgh-x77r

Charts affected

35 by stars

Chart

Latest

Affected images

Radar Score

difydouban

1 of 6 See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
langgenius/dify-web :1.10.1-fix.1	c306ac577912	pnpm@10.22.0	10.34.2

Open the chart page →

19,391

openclawopenclaw-helm

1 of 2 See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	pnpm@11.2.2	11.5.3

Open the chart page →

5,660

umamichristianhuth

1 of 2 See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	pnpm@10.24.0	10.34.2

Open the chart page →

2,367

syftopenmined

1 of 6 See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
openmined/syft-frontend :0.9.5	d11524a3854a	pnpm@10.3.0	10.34.2

Open the chart page →

17,245

docmosthelmforge

1 of 4 See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
docmost/docmost :0.95.0	41c8d777cf23	pnpm@10.4.0	10.34.2

Open the chart page →

5,564

hoppscotchdeliveryhero

1 of 1 See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	pnpm@9.10.0	10.34.2

Open the chart page →

3,451

activepiecesmeyercharts

1 of 1 See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
activepieces/activepieces :0.23.0	c26188b44e62	pnpm@7.28.0	10.34.2

Open the chart page →

2,635

openclaw-with-brainopenclaw-with-brain

1 of 3 See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	pnpm@11.2.2	11.5.3

Open the chart page →

5,218

litlyxlitlyx

2 of 5 See more

litlyx litlyx 0.2.0

2 of the 5 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
litlyx/litlyx-consumer :latest	02225e77d316	pnpm@10.23.0	10.34.2
litlyx/litlyx-producer :latest	10407f36613f	pnpm@10.23.0	10.34.2

Open the chart page →

7,874

peertubepeertube

1 of 1 See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
chocobozzz/peertube :v8.1.5	052712130691	pnpm@10.15.1	10.34.2

Open the chart page →

7,035

rocketadminrocketadmin

1 of 1 See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
rocketadmin/rocketadmin :1.17.7	10955ef540b9	pnpm@10.33.0	10.34.2

Open the chart page →

5,482

jellyseerrrtomik-helm-charts

1 of 1 See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	pnpm@9.15.9	10.34.2

Open the chart page →

2,823

astrotrekastria

1 of 4 See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	pnpm@9.10.0	10.34.2

Open the chart page →

32,501

nas-appsawesome

1 of 8 See more

nas-apps awesome 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
wettyoss/wetty :latest	7423b3d40ba2	pnpm@9.15.9	10.34.2

Open the chart page →

7,152

cloudpremcloudprem

0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of 6 See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	pnpm@10.17.0	10.34.2
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	pnpm@10.17.0	10.34.2

Open the chart page →

18,293

dev-code-servercosmo

1 of 2 See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	pnpm@10.8.0	10.34.2

Open the chart page →

14,559

difydify

1 of 4 See more

19,224

consent-managerfiware

1 of 1 See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
quay.io/wi_stefan/consent-manager :0.0.6	56399619568b	pnpm@8.15.9	10.34.2

Open the chart page →

1,847

hoppscotchhelm-charts-nr

1 of 1 See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	pnpm@9.10.0	10.34.2

Open the chart page →

3,451

hoppscotchhoppscotch

1 of 1 See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
hoppscotch/hoppscotch :2024.11.0	538fe6ded4b6	pnpm@9.14.2	10.34.2

Open the chart page →

3,614

ghostjanip81-helm-charts

1 of 1 See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
library/ghost :6.37.0	1ef2e532ca4d	pnpm@10.33.0	10.34.2

Open the chart page →

3,436

ghostk8s-home-lab-repo

1 of 1 See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
library/ghost :6.41.1	29773d6be407	pnpm@10.33.0	10.34.2

Open the chart page →

3,092

component-storekubebb

1 of 1 See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
kubebb/component-store :latest	fd8ecbd73213	pnpm@8.15.1	10.34.2

Open the chart page →

2,178

u4a-componentkubebb

1 of 8 See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
kubebb/bff-server :v0.2.0-20231204	0fbb732379bc	pnpm@8.10.2	10.34.2

Open the chart page →

13,819

ghostkubernetes-homelab-helm-charts

1 of 2 See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
library/ghost :6.39.0-alpine	77196da4b0df	pnpm@11.1.2	11.5.3

Open the chart page →

2,756

umamikubernetes-homelab-helm-charts

1 of 3 See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	pnpm@10.33.0	10.34.2

Open the chart page →

2,596

jellyseerrlbenicio-community

1 of 1 See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
fallenbagel/jellyseerr :latest	4538137bc5af	pnpm@9.15.9	10.34.2

Open the chart page →

3,555

hyperglassm0nsterrr-hyperglass

1 of 2 See more

hyperglass m0nsterrr-hyperglass 4.2.1

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	pnpm@9.5.0	10.34.2

Open the chart page →

4,647

magistralamagistrala-devops

1 of 42 See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	pnpm@10.12.1	10.34.2

Open the chart page →

24,400

tianjimsgbyte

1 of 2 See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
moonrailgun/tianji :1.11.2	b528c8f8fcc4	pnpm@8.3.1	10.34.2

Open the chart page →

4,560

umamimt190502

1 of 3 See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	pnpm@10.25.0	10.34.2

Open the chart page →

4,016

nostreamnostream

1 of 1 See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/cameri/nostream :main	8726533b9e69	pnpm@10.33.0	10.34.2

Open the chart page →

595

firecrawlobeone

1 of 5 See more

firecrawl obeone 3.0.1

1 of the 5 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
ghcr.io/firecrawl/firecrawl :2.11.330	92ee28c20a0d	pnpm@11.4.0	11.5.3

Open the chart page →

9,995

etherpadschoenwald

1 of 1 See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
etherpad/etherpad :2.7.2	b723fe5f2594	pnpm@10.33.0	10.34.2

Open the chart page →

2,133

tensorzerotensorzero

1 of 2 See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-55180.

Container image	Digest	Package	Fixed in
tensorzero/ui :2026.6.0	f2563d54724e	pnpm@11.5.1	11.5.3

Open the chart page →

3,972

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	pnpm@9.10.0	10.34.2	2
activepieces/activepieces :0.23.0	c26188b44e62	pnpm@7.28.0	10.34.2	1
chocobozzz/peertube :v8.1.5	052712130691	pnpm@10.15.1	10.34.2	1
docmost/docmost :0.95.0	41c8d777cf23	pnpm@10.4.0	10.34.2	1
etherpad/etherpad :2.7.2	b723fe5f2594	pnpm@10.33.0	10.34.2	1
fallenbagel/jellyseerr :latest	4538137bc5af	pnpm@9.15.9	10.34.2	1
hoppscotch/hoppscotch :2024.11.0	538fe6ded4b6	pnpm@9.14.2	10.34.2	1
kubebb/bff-server :v0.2.0-20231204	0fbb732379bc	pnpm@8.10.2	10.34.2	1
kubebb/component-store :latest	fd8ecbd73213	pnpm@8.15.1	10.34.2	1
langgenius/dify-web :1.10.1-fix.1	c306ac577912	pnpm@10.22.0	10.34.2	1
langgenius/dify-web :1.0.0	d64914ff0d6d	pnpm@9.12.2	10.34.2	1
library/ghost :6.37.0	1ef2e532ca4d	pnpm@10.33.0	10.34.2	1
library/ghost :6.41.1	29773d6be407	pnpm@10.33.0	10.34.2	1
library/ghost :6.39.0-alpine	77196da4b0df	pnpm@11.1.2	11.5.3	1
litlyx/litlyx-consumer :latest	02225e77d316	pnpm@10.23.0	10.34.2	1
litlyx/litlyx-producer :latest	10407f36613f	pnpm@10.23.0	10.34.2	1
moonrailgun/tianji :1.11.2	b528c8f8fcc4	pnpm@8.3.1	10.34.2	1
openmined/syft-frontend :0.9.5	d11524a3854a	pnpm@10.3.0	10.34.2	1
rocketadmin/rocketadmin :1.17.7	10955ef540b9	pnpm@10.33.0	10.34.2	1
tensorzero/ui :2026.6.0	f2563d54724e	pnpm@11.5.1	11.5.3	1
wettyoss/wetty :latest	7423b3d40ba2	pnpm@9.15.9	10.34.2	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	pnpm@10.12.1	10.34.2	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	pnpm@9.10.0	10.34.2	1
ghcr.io/cameri/nostream :main	8726533b9e69	pnpm@10.33.0	10.34.2	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	pnpm@10.8.0	10.34.2	1
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	pnpm@9.15.9	10.34.2	1
ghcr.io/firecrawl/firecrawl :2.11.330	92ee28c20a0d	pnpm@11.4.0	11.5.3	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	pnpm@10.17.0	10.34.2	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	pnpm@10.17.0	10.34.2	1
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	pnpm@9.5.0	10.34.2	1
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	pnpm@11.2.2	11.5.3	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	pnpm@11.2.2	11.5.3	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	pnpm@10.25.0	10.34.2	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	pnpm@10.24.0	10.34.2	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	pnpm@10.33.0	10.34.2	1
quay.io/wi_stefan/consent-manager :0.0.6	56399619568b	pnpm@8.15.9	10.34.2	1