StackRadar

CVE-2026-56858

Medium

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,609
of 17,821 indexed, latest versions
Container images
5,337
deployed by those charts
Fix available
1 of 2
affected packages

Fix Javascript regexp context tracking in html/template

Carried by container images the latest versions of 4,609 of 17,821 indexed charts deploy, on 5,337 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+193 more1.25.135,337
OSV records
DEBIAN-CVE-2026-56858GO-2026-6091
Also known as
BIT-golang-2026-56858

Charts affected

4,609 by stars
ChartLatestAffected imagesRadar Score
synergy-wholesale-exporteryungwoodVerified publisher0.1.11 of 1See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
yungwood/synergy-wholesale-exporter:0.1.1054dce85989b
stdlib@go1.26.5
1.25.13

Open the chart page →

60
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
stdlib@go1.20.4
1.25.13
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
stdlib@go1.20.4
1.25.13

Open the chart page →

5,077
zahori-moonzahoriVerified publisher1.0.13 of 3See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
quay.io/aerokube/moon:2.5.1a8837b00ba1c
stdlib@go1.20.4
1.25.13
quay.io/aerokube/moon-conf:2.5.19ca307b30080
stdlib@go1.20.4
1.25.13
quay.io/aerokube/moon-ui:2.0.589990b146824
stdlib@go1.20.5
1.25.13

Open the chart page →

2,908
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.13

Open the chart page →

2,485
posthogzeet0.23.22 of 9See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.13
altinity/metrics-exporter:latest8940ecadae65
stdlib@go1.26.5
1.25.13

Open the chart page →

3,701
endlessh-gozekker6Verified publisher0.4.01 of 1See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
ghcr.io/shizunge/endlessh-go:2026.0730.08826dad32623
stdlib@go1.26.5
1.25.13

Open the chart page →

411
karmazekker6Verified publisher0.21.01 of 1See more

karma zekker6 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
ghcr.io/prymitive/karma:v0.13298d9ed609118
stdlib@go1.26.5
1.25.13

Open the chart page →

56
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.13

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.42 of 6See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-56858.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.13
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
stdlib@go1.26.5
1.25.13

Open the chart page →

7,966

Container images carrying it

5,337 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
garethgeorge/backrest:v1.14.1b85297975428
stdlib@go1.26.0
1.25.13
1
garugaru/presto-exporter:cb666560e9e82d5ae36aef1e663c3d7f51cca9fc5201314c28f3
stdlib@go1.14.13
1.25.13
1
garugaru/presto-loadbalancer:v0.1.589d66d117029
stdlib@go1.15.2
1.25.13
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
stdlib@go1.17.9
1.25.13
1
gdxbsv/traktor:0.0.17675693335054
stdlib@go1.24.13
1.25.13
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
stdlib@go1.19.11
1.25.13
1
geoservercloud/geoserver-cloud-gateway:3.0.1.1de0b20bd2a43
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
stdlib@go1.26.5
1.25.13
1
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
stdlib@go1.26.5
1.25.13
1
gesellix/couchdb-prometheus-exporter:v27.2.05b891f1fc2b9
stdlib@go1.13.10
1.25.13
1
gesellix/couchdb-prometheus-exporter:v286266d063f5d5
stdlib@go1.13.13
1.25.13
1
getconvoy/convoy:v26.7.6f4934cc05e31
stdlib@go1.26.2
1.25.13
1
getsentry/relay:24.10.0ba7bf9163219
stdlib@go1.19.8
1.25.13
1
ghusta/postgres-world-db:latest879d0919fdcc
stdlib@go1.24.6
1.25.13
1
giantswarm/silence-operator:0.13.0a6cac55aa2d4
stdlib@go1.24.1
1.25.13
1
gidoichi/secrets-store-csi-driver-provider-infisical:v1.1.42dd5322a0610
stdlib@go1.26.5
1.25.13
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
stdlib@go1.22.7
1.25.13
1
gitea/act_runner:nightly7940221bcfc9
stdlib@go1.26.2
1.25.13
1
gitea/act_runner:latestb5c35d6bdbb9
stdlib@go1.26.2
1.25.13
1
gitea/act_runner:0.3.1c2a169c5e998
stdlib@go1.26.1
1.25.13
1
gitea/act_runner:0.2.11c57233403eff
stdlib@go1.23.1
1.25.13
1
gitea/gitea:1.27.134e3f6b75f5c
stdlib@go1.26.5-X:jsonv2
1.25.13
1
gitea/gitea:1.22.376f516a1a8c2
stdlib@go1.22.8
1.25.13
1
gitea/gitea:1.26.27d13848af126
stdlib@go1.26.3-X:jsonv2
1.25.13
1
gitea/gitea:1.12.485416d6f65fe
stdlib@go1.14.8
1.25.13
1
gitea/gitea:1.21.6ac73e0da341f
stdlib@go1.21.7
1.25.13
1
gitea/gitea:1.16.8b0bdf102b485
stdlib@go1.18.2
1.25.13
1
gitea/gitea:1.13.0d5ab14cd29af
stdlib@go1.15.5
1.25.13
1
gitlab/gitlab-runner:v15.3.0860d4a3fec7a
stdlib@go1.17.9
1.25.13
1
gitlab/gitlab-runner:alpine-v13.2.1fd7e5dfb9f30
stdlib@go1.13.8
1.25.13
1
gkarthics/container-resource-exporter:latest6799af333e8a
stdlib@go1.14.7
1.25.13
1
glanceapp/glance:v0.8.532ab73d80f2b
stdlib@go1.26.3
1.25.13
1
glanceapp/glance:v0.8.46df86a7e8868
stdlib@go1.24.3
1.25.13
1
glasskube/operator:0.12.2be5133100d63
stdlib@go1.20.8
1.25.13
1
goalert/goalert:v0.32.008d57388b0cb
stdlib@go1.22.1
1.25.13
1
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
stdlib@go1.23.5
1.25.13
1
goccx/go-file-server:latestf4b3ebea0303
stdlib@go1.21.10
1.25.13
1
gocrane/craned:v0.5.1a1400909118c
stdlib@go1.17.2
1.25.13
1
gocrane/crane-scheduler:0.0.239ba6d11b2079
stdlib@go1.17.2
1.25.13
1
gocrane/crane-scheduler-controller:0.1.23a2d7e60576f9
stdlib@go1.17.2
1.25.13
1
gogs/gogs:0.12.30195b095d0b2
stdlib@go1.14.7
1.25.13
1
gogs/gogs:0.12.1420d53bb7277
stdlib@go1.14.7
1.25.13
1
goharbor/chartmuseum-photon:v2.5.36ab3ca28e9e5
stdlib@go1.17.7
1.25.13
1
goharbor/harbor-acceld:0.2.13451103a6c8d8
stdlib@go1.21.5
1.25.13
1
goharbor/harbor-core:v2.9.06412d679fdc3
stdlib@go1.20.7
1.25.13
1
goharbor/harbor-core:v2.5.386bf3031f4a7
stdlib@go1.17.7
1.25.13
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.