StackRadar

CVE-2026-59895

Medium

Advisory

Published 21 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
22
of 17,781 indexed, latest versions
Container images
25
deployed by those charts
Fix available
1 of 1
affected package

Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 25 images.

Affected packageAffected versionsFixed inImages
hononpm4.6.12, 4.7.11, 4.10.4, 4.11.4+10 more4.12.2725
OSV records
GHSA-w62v-xxxg-mg59

Charts affected

22 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.12.27
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.12.27
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.12.27
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.12.27

Open the chart page →

12,279
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.12.27

Open the chart page →

5,660
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.12.27

Open the chart page →

5,564
ghostcloudpirates-ghostVerified publisher0.20.221 of 3See more

ghost cloudpirates-ghost 0.20.22

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.27

Open the chart page →

7,146
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.12.27

Open the chart page →

28,839
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.12.27

Open the chart page →

1,447
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.12.27

Open the chart page →

5,218
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.12.27

Open the chart page →

4,016
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.12.27

Open the chart page →

7,473
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.12.27

Open the chart page →

3,123
ghostgroundhog2k0.212.121 of 1See more

ghost groundhog2k 0.212.12

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.27

Open the chart page →

2,000
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.12.27

Open the chart page →

2,575
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.12.27

Open the chart page →

5,213
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.12.27
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.12.27

Open the chart page →

3,600
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.12.27

Open the chart page →

1,947
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.12.27

Open the chart page →

739
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.12.27

Open the chart page →

2,463
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.12.27

Open the chart page →

1,498
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.12.27

Open the chart page →

2,596
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.12.27

Open the chart page →

1,852
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.12.27

Open the chart page →

4,684
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-59895.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.12.27

Open the chart page →

2,028

Container images carrying it

25 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/ghost:6.63.0e05bc1169fb2
hono@4.12.18
4.12.27
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.12.27
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.12.27
1
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.12.27
1
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.12.27
1
docmost/docmost:0.95.041c8d777cf23
hono@4.12.25
4.12.27
1
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.12.27
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.12.27
1
library/ghost:6.62.0a7a268bbfb7f
hono@4.12.18
4.12.27
1
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.12.27
1
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.12.27
1
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.12.27
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.12.27
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.12.27
1
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.12.27
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.12.27
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.12.27
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.12.27
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
hono@4.12.26
4.12.27
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.12.27
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
hono@4.12.25
4.12.27
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.12.27
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
hono@4.12.18
4.12.27
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.12.27
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.12.27
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.