StackRadar

CVE-2026-71438

Low

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.4
base score, highest
EPSS
0.002
10th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
15
of 17,781 indexed, latest versions
Container images
14
deployed by those charts
Fix available
1 of 1
affected package

Mermaid configuration APIs allow prototype pollution

Carried by container images the latest versions of 15 of 17,781 indexed charts deploy, on 14 images.

Affected packageAffected versionsFixed inImages
mermaidnpm8.8.4, 8.10.2, 8.13.2, 8.13.8+9 more10.9.8, 11.16.114
OSV records
GHSA-c4c3-pg64-4m4v

Charts affected

15 by stars
ChartLatestAffected imagesRadar Score
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
mermaid@9.3.0
10.9.8

Open the chart page →

4,431
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
mermaid@11.4.1
11.16.1

Open the chart page →

5,352
krokicowboysysopVerified publisher6.1.01 of 5See more

kroki cowboysysop 6.1.0

1 of the 5 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
yuzutech/kroki-excalidraw:0.29.157917319ea70
mermaid@10.9.3
10.9.8

Open the chart page →

6,743
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
mermaid@10.6.1
10.9.8

Open the chart page →

3,925
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
mermaid@8.13.8
10.9.8

Open the chart page →

7,801
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
mermaid@11.15.0
11.16.1

Open the chart page →

18,075
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
mermaid@11.12.3
11.16.1

Open the chart page →

3,600
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
mermaid@11.12.2
11.16.1

Open the chart page →

4,650
kyso-frontkyso1.0.01 of 1See more

kyso-front kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
kyso/kyso-front:lateste52595c5c16f
mermaid@9.1.6
10.9.8

Open the chart page →

2,685
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
mermaid@8.8.4
10.9.8

Open the chart page →

27,465
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
mermaid@8.10.2
10.9.8

Open the chart page →

6,524
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
mermaid@10.9.1
10.9.8

Open the chart page →

7,413
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
mermaid@9.3.0
10.9.8

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
mermaid@8.13.2
10.9.8

Open the chart page →

3,638
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-71438.

Container imageDigestPackageFixed in
supabase/studio:latest94a2a9d2906e
mermaid@11.15.0
11.16.1

Open the chart page →

9,556

Container images carrying it

14 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
outlinewiki/outline:0.69.1d060dcd8f9aa
mermaid@9.3.0
10.9.8
2
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
mermaid@11.12.3
11.16.1
1
flanksource/canary-checker-ui:v1.4.281764c84e550db
mermaid@11.12.2
11.16.1
1
joplin/server:3.0-beta52af57880c0e
mermaid@10.9.1
10.9.8
1
joplin/server:2.14.2-betab87564ef34e9
mermaid@10.6.1
10.9.8
1
kyso/kyso-front:lateste52595c5c16f
mermaid@9.1.6
10.9.8
1
linuxserver/codimd:latestb801bbcf6386
mermaid@8.8.4
10.9.8
1
outlinewiki/outline:0.82.0494dfb9249a6
mermaid@11.4.1
11.16.1
1
phntom/codimd:2.4.31b9aafbb62e6
mermaid@8.10.2
10.9.8
1
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
mermaid@11.15.0
11.16.1
1
supabase/studio:latest94a2a9d2906e
mermaid@11.15.0
11.16.1
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
mermaid@8.13.8
10.9.8
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
mermaid@10.9.3
10.9.8
1
quay.io/wekan/wekan:v5.65cb17600883a3
mermaid@8.13.2
10.9.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.