StackRadar

CVE-2026-83614

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
59
of 17,781 indexed, latest versions
Container images
52
deployed by those charts
Fix available
1 of 2
affected packages

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 52 images.

Affected packageAffected versionsFixed inImages
@xmldom/xmldomnpm0.7.5, 0.7.9, 0.8.6, 0.8.10+5 more0.8.15, 0.9.1241
xmldomnpm0.3.0, 0.4.0, 0.5.0, 0.6.0no fix listed12
OSV records
GHSA-93r5-fhx6-vmg9

Charts affected

59 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,352
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,639
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

2,938
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,564
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
xmldom@0.5.0
no fix listed

Open the chart page →

5,946
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

9,460
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
@xmldom/xmldom@0.7.5
0.8.15
kobotoolbox/kpi:2.022.24dbcacc01bccd4
xmldom@0.5.0
no fix listed

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
@xmldom/xmldom@0.8.6
0.8.15

Open the chart page →

7,776
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

977
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

4,016
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

2,851
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

1,044
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

7,473
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,322
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

31,844
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

5,213
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,833
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,685
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,551
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

1,755
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
@xmldom/xmldom@0.7.9
xmldom@0.6.0
0.8.15
no fix listed

Open the chart page →

3,159
mod-graphqlfolio-org0.1.301 of 1See more

mod-graphql folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
folioci/mod-graphql:latestf0655a6a08fd
xmldom@0.6.0
no fix listed

Open the chart page →

1,091
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
xmldom@0.3.0
no fix listed

Open the chart page →

89,959
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,769
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

2,538
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

4,253
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,014
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
xmldom@0.4.0
no fix listed

Open the chart page →

7,232
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,826
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
xmldom@0.5.0
no fix listed

Open the chart page →

3,397
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

5,410
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

9,668
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
xmldom@0.3.0
no fix listed

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
xmldom@0.3.0
no fix listed

Open the chart page →

7,027
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
xmldom@0.4.0
no fix listed

Open the chart page →

27,465
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,219
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

895
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

5,338
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,819
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

3,118
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-83614.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

2,638

Container images carrying it

52 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
0.8.15
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.