CVE-2026-83614
HighAdvisory
Published 8 Sept 2026In the index since 9 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 59
- of 17,781 indexed, latest versions
- Container images
- 52
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 52 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| @xmldom/ | 0.7.5, 0.7.9, 0.8.6, 0.8.10+5 more | 0.8.15, 0.9.12 | 41 |
| xmldomnpm | 0.3.0, 0.4.0, 0.5.0, 0.6.0 | no fix listed | 12 |
- OSV records
- GHSA-93r5-fhx6-vmg9
Charts affected
59 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| n8ncommunity-chartsVerified publisher | 1.24.40 | 1 of 1See more | 772 |
| n8nopen-8gears | 2.1.1 | 1 of 1See more | 1,038 |
| outlinekubitodevVerified publisher | 1.2.2 | 1 of 4See more | 5,352 |
| n8nn8n | 0.23.0 | 1 of 1See more | 5,639 |
| hedgedocadfinisVerified publisher | 0.6.1 | 1 of 2See more | 2,938 |
| n8nhelmforgeVerified publisher | 2.0.0 | 1 of 2See more | 863 |
| docmosthelmforgeVerified publisher | 1.2.11 | 1 of 4See more | 5,564 |
| wikijsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 5,946 |
| karakeephelmforgeVerified publisher | 1.2.9 | 1 of 3See more | 9,460 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| n8none-acre-fundVerified publisher | 0.1.52 | 1 of 3See more | 7,776 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 977 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| predatorzooz | 1.7.0 | 1 of 1See more | 2,851 |
| aapbaapbVerified publisher | 0.1.3 | 1 of 1See more | 1,044 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| keycloak-reporterkeycloak-reporterVerified publisher | 1.4.15 | 1 of 1See more | 1,322 |
| n8nn8n-helm | 2.25.7 | 1 of 1See more | 2,575 |
| portraitportraitVerified publisher | 0.2.13 | 1 of 8See more | 31,844 |
| karakeepself-hosters-by-nightVerified publisher | 2.5.1 | 1 of 1See more | 5,213 |
| wikiwenerme | 2.2.0 | 1 of 2See more | 3,833 |
| decisionrules-aksdecisionrules-aksVerified publisher | 0.2.0 | 1 of 2See more | 1,138 |
| decisionrules-eksdecisionrules-eksVerified publisher | 0.3.0 | 1 of 2See more | 1,138 |
| decisionrules-ingressdecisionrules-ingressVerified publisher | 0.2.0 | 1 of 2See more | 1,138 |
| decisionrules-ocpdecisionrules-ocpVerified publisher | 0.1.0 | 1 of 4See more | 2,685 |
| directusdirectusVerified publisher | 0.9.10 | 1 of 4See more | 4,551 |
| hedgedocernail-hedgedoc | 5.0.0 | 1 of 1See more | 1,755 |
| keyrockfiware | 0.8.7 | 1 of 1See more | 3,159 |
| mod-graphqlfolio-org | 0.1.30 | 1 of 1See more | 1,091 |
| streamsheetshelm-chartsVerified publisher | 0.2.3 | 4 of 8See more | 89,959 |
| automatischhelmforgeVerified publisher | 1.3.7 | 1 of 4See more | 5,769 |
| paprahelmforgeVerified publisher | 1.0.0 | 1 of 1See more | 2,538 |
| wikijshomeenterpriseinc | 1.4.0 | 1 of 1See more | 4,253 |
| infisicalinfisical-charts | 0.4.2 | 1 of 3See more | 3,014 |
| backstageirembo-backstage-helmVerified publisher | 1.0.5 | 1 of 3See more | 7,232 |
| n8njanip81-helm-chartsVerified publisher | 0.1.4 | 1 of 1See more | 5,826 |
| sqlpadkronkltdVerified publisher | 0.1.0 | 1 of 1See more | 3,397 |
| tooljetkrzwiatrzyk | 1.1.1 | 1 of 2See more | 5,410 |
| backstagemcwarmanVerified publisher | 0.10.10 | 1 of 2See more | 9,668 |
| kommandermesosphere-stable | 0.39.2 | 1 of 29See more | 68,284 |
| opsportalmesosphere-stable | 0.9.5 | 1 of 3See more | 7,027 |
| n8nn8n-openshiftVerified publisher | 1.18.0 | 1 of 1See more | 1,038 |
| example-dev-toolsnoygal | 0.2.8 | 1 of 3See more | 27,465 |
| nocodbone-acre-fundVerified publisher | 0.4.6 | 1 of 3See more | 4,219 |
| n8nopenshift | 1.18.0 | 1 of 1See more | 1,038 |
| etherpadredhat-cop | 0.0.8 | 1 of 1See more | 895 |
| karakeeprtomik-helm-chartsVerified publisher | 0.0.1 | 1 of 3See more | 5,338 |
| rybbitrybbit-helm | 1.3.0 | 1 of 7See more | 5,819 |
| hedgedocschmitzis | 0.1.12 | 1 of 1See more | 3,118 |
| hedgedocsi-gitops | 0.12.3 | 1 of 2See more | 2,638 |
Container images carrying it
52 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| decisionrules/ | f38d8571fa06 | @xmldom/ | 0.8.15 | 4 |
| quay.io/ | 89bd85d7817f | @xmldom/ | 0.8.15 | 3 |
| infisical/ | 02082bf13163 | @xmldom/ | 0.8.15 | 2 |
| mesosphere/ | 3917e82333a9 | xmldom | no fix listed | 2 |
| n8nio/ | 14c4285bc303 | @xmldom/ | 0.8.15 | 2 |
| n8nio/ | 5d9f0cc5672b | @xmldom/ | 0.8.15 | 2 |
| requarks/ | 68f0d1848261 | @xmldom/ | 0.8.15 | 2 |
| quay.io/ | e09967519a1d | @xmldom/ | 0.8.15 | 2 |
| automatischio/ | 3bace7a12d5f | @xmldom/ | 0.8.15 | 1 |
| continuoussecuritytooling/ | f04ecefab64e | @xmldom/ | 0.8.15 | 1 |
| directus/ | 9c8470ea465c | @xmldom/ | 0.8.15 | 1 |
| directus/ | e3c8bb975350 | @xmldom/ | 0.8.15 | 1 |
| docmost/ | 41c8d777cf23 | @xmldom/ | 0.8.15 | 1 |
| enketo/ | dcad9c2273f6 | @xmldom/ | 0.8.15 | 1 |
| etherpad/ | 6020e7b57f4b | @xmldom/ | 0.8.15 | 1 |
| fiware/ | a1b6ed4ae84f | @xmldom/ xmldom | 0.8.15 no fix listed | 1 |
| folioci/ | f0655a6a08fd | xmldom | no fix listed | 1 |
| joplin/ | 3f7b852959aa | @xmldom/ | 0.8.15 | 1 |
| kobotoolbox/ | bcacc01bccd4 | xmldom | no fix listed | 1 |
| linuxserver/ | b801bbcf6386 | xmldom | no fix listed | 1 |
| n8nio/ | 761374d4eb84 | @xmldom/ | 0.8.15 | 1 |
| n8nio/ | 8b39ed5a2de9 | @xmldom/ | 0.8.15 | 1 |
| n8nio/ | a9195bc499a3 | @xmldom/ | 0.8.15 | 1 |
| n8nio/ | cfe2704ff858 | @xmldom/ | 0.8.15 | 1 |
| n8nio/ | dd171d45102a | @xmldom/ | 0.8.15 | 1 |
| nocodb/ | 6779a4ddedf2 | @xmldom/ | 0.8.15 | 1 |
| nocodb/ | d9516f0bf546 | @xmldom/ | 0.8.15 | 1 |
| outlinewiki/ | 494dfb9249a6 | @xmldom/ | 0.8.15 | 1 |
| requarks/ | 8b5865a7386c | @xmldom/ | 0.8.15 | 1 |
| roadiehq/ | ef355bf5b639 | xmldom | no fix listed | 1 |
| samajh/ | 05ef4fddbb75 | @xmldom/ | 0.8.15 | 1 |
| sqlpad/ | d3d2f430dffd | xmldom | no fix listed | 1 |
| tooljet/ | c85a4720e42e | @xmldom/ | 0.8.15 | 1 |
| treskon/ | e7970783bc8d | @xmldom/ | 0.8.15 | 1 |
| twentycrm/ | e7d9948bf284 | @xmldom/ | 0.8.15 | 1 |
| unleashorg/ | 245aeba40053 | @xmldom/ | 0.8.15 | 1 |
| zooz/ | f491d1f7a865 | @xmldom/ | 0.8.15 | 1 |
| ghcr.io/ | e103abadfb52 | @xmldom/ | 0.8.15 | 1 |
| ghcr.io/ | 7006cac874fd | @xmldom/ | 0.8.15 | 1 |
| ghcr.io/ | 0635f17c9d2c | xmldom | no fix listed | 1 |
| ghcr.io/ | e34964e336c1 | xmldom | no fix listed | 1 |
| ghcr.io/ | 0c5a3398d1e4 | xmldom | no fix listed | 1 |
| ghcr.io/ | 8ba040e79ca0 | xmldom | no fix listed | 1 |
| ghcr.io/ | abd7d6b11b1b | @xmldom/ | 0.9.12 | 1 |
| ghcr.io/ | b069e4307dec | @xmldom/ | 0.9.12 | 1 |
| ghcr.io/ | f575a34ed3f8 | @xmldom/ | 0.9.12 | 1 |
| ghcr.io/ | 58d377933678 | xmldom | no fix listed | 1 |
| ghcr.io/ | 07aba09a594f | @xmldom/ | 0.8.15 | 1 |
| ghcr.io/ | a281cb44176d | @xmldom/ | 0.8.15 | 1 |
| ghcr.io/ | e0d1b397e33c | @xmldom/ | 0.8.15 | 1 |