StackRadar

CVE-2026-83613

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 2
affected packages

xmldom: Quadratic-time attribute deduplication

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
@xmldom/xmldomnpm0.7.5, 0.7.9, 0.8.6, 0.8.10+5 more0.8.15, 0.9.1241
xmldomnpm0.1.19, 0.1.27, 0.1.31, 0.3.0+3 moreno fix listed24
OSV records
GHSA-8344-3jmq-59r6

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
xmldom@0.1.27
no fix listed

Open the chart page →

6,524
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

895
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
xmldom@0.1.19
no fix listed

Open the chart page →

5,215
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

5,338
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,819
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

3,118
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
xmldom@0.1.19
no fix listed

Open the chart page →

3,638
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

2,638
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,014
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

20,270
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

2,028
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

2,789
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

2,076
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

3,118
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-83613.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,459

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15
4
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
xmldom@0.1.31
0.8.15
no fix listed
3
infisical/infisical:latest:v0.165.602082bf13163
@xmldom/xmldom@0.8.13
0.8.15
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
xmldom@0.1.27
no fix listed
2
mesosphere/kommander:6.100.13917e82333a9
xmldom@0.3.0
no fix listed
2
migmartri/prerender:latest486aacfd5aa9
xmldom@0.1.27
no fix listed
2
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15
2
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15
2
requarks/wiki:2:latest68f0d1848261
@xmldom/xmldom@0.8.13
0.8.15
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
xmldom@0.1.31
0.8.15
no fix listed
2
automatischio/automatisch:0.15.03bace7a12d5f
@xmldom/xmldom@0.8.10
0.8.15
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
@xmldom/xmldom@0.8.13
0.8.15
1
directus/directus:12.0.29c8470ea465c
@xmldom/xmldom@0.8.13
0.8.15
1
directus/directus:11.1.0e3c8bb975350
@xmldom/xmldom@0.8.10
0.8.15
1
docmost/docmost:0.95.041c8d777cf23
@xmldom/xmldom@0.8.13
0.8.15
1
enketo/enketo-express:3.0.4dcad9c2273f6
@xmldom/xmldom@0.7.5
0.8.15
1
etherpad/etherpad:latest6020e7b57f4b
@xmldom/xmldom@0.8.13
0.8.15
1
fiware/idm:8.3.3a1b6ed4ae84f
@xmldom/xmldom@0.7.9
xmldom@0.6.0
0.8.15
no fix listed
1
folioci/mod-graphql:latestf0655a6a08fd
xmldom@0.6.0
no fix listed
1
gristlabs/grist:0.7.96e71b1914a7e
xmldom@0.1.19
no fix listed
1
joplin/server:latest3f7b852959aa
@xmldom/xmldom@0.8.13
0.8.15
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
xmldom@0.5.0
no fix listed
1
linuxserver/codimd:latestb801bbcf6386
xmldom@0.4.0
no fix listed
1
n8nio/n8n:2.25.7761374d4eb84
@xmldom/xmldom@0.8.13
0.8.15
1
n8nio/n8n:1.86.08b39ed5a2de9
@xmldom/xmldom@0.8.10
0.8.15
1
n8nio/n8n:0.212.0a9195bc499a3
@xmldom/xmldom@0.8.6
0.8.15
1
n8nio/n8n:2.36.8cfe2704ff858
@xmldom/xmldom@0.8.14
0.8.15
1
n8nio/n8n:1.33.1dd171d45102a
@xmldom/xmldom@0.8.10
0.8.15
1
nocodb/nocodb:0.258.06779a4ddedf2
@xmldom/xmldom@0.8.10
0.8.15
1
nocodb/nocodb:0.301.5d9516f0bf546
@xmldom/xmldom@0.8.11
0.8.15
1
outlinewiki/outline:0.82.0494dfb9249a6
@xmldom/xmldom@0.8.10
0.8.15
1
phntom/codimd:2.4.31b9aafbb62e6
xmldom@0.1.27
no fix listed
1
requarks/wiki:canary-2.5.2438b5865a7386c
@xmldom/xmldom@0.7.5
xmldom@0.1.31
0.8.15
no fix listed
1
roadiehq/community-backstage-image:latestef355bf5b639
xmldom@0.1.27
no fix listed
1
samajh/alprfrontend:latest05ef4fddbb75
@xmldom/xmldom@0.7.5
0.8.15
1
sqlpad/sqlpad:6.7d3d2f430dffd
xmldom@0.5.0
no fix listed
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@xmldom/xmldom@0.7.5
0.8.15
1
treskon/portrait-ui:DEV-lateste7970783bc8d
@xmldom/xmldom@0.8.10
0.8.15
1
twentycrm/twenty:v2.22.0e7d9948bf284
@xmldom/xmldom@0.8.13
0.8.15
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
@xmldom/xmldom@0.8.10
0.8.15
1
zazuko/trifid:2.3.7054be137de70
xmldom@0.1.19
no fix listed
1
zooz/predator:1.6f491d1f7a865
@xmldom/xmldom@0.7.5
0.8.15
1
ghcr.io/ajnart/homarr:lateste103abadfb52
@xmldom/xmldom@0.8.10
0.8.15
1
ghcr.io/colanode/server:latest7006cac874fd
@xmldom/xmldom@0.8.12
0.8.15
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
xmldom@0.3.0
no fix listed
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
xmldom@0.3.0
no fix listed
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
xmldom@0.3.0
no fix listed
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
xmldom@0.3.0
no fix listed
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
@xmldom/xmldom@0.9.6
0.9.12
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
@xmldom/xmldom@0.9.6
0.9.12
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.