StackRadar

CVE-2026-83616

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 2
affected packages

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
@xmldom/xmldomnpm0.7.5, 0.7.9, 0.8.6, 0.8.10+5 more0.8.15, 0.9.1241
xmldomnpm0.1.19, 0.1.27, 0.1.31, 0.3.0+3 moreno fix listed24
OSV records
GHSA-c7q8-3ch8-vqpv

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,352
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,639
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

2,938
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,564
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
xmldom@0.1.27
no fix listed

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
xmldom@0.1.31
no fix listed

Open the chart page →

5,946
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

9,460
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
@xmldom/xmldom@0.7.5
0.8.15
kobotoolbox/kpi:2.022.24dbcacc01bccd4
xmldom@0.5.0
no fix listed

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
@xmldom/xmldom@0.8.6
0.8.15

Open the chart page →

7,776
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

977
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

4,016
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

2,851
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

1,044
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

7,473
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,322
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

31,844
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
@xmldom/xmldom@0.9.6
0.9.12

Open the chart page →

5,213
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,833
trifidappuio2.0.21 of 1See more

trifid appuio 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
zazuko/trifid:2.3.7054be137de70
xmldom@0.1.19
no fix listed

Open the chart page →

2,783
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,685
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,551
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
xmldom@0.1.31
no fix listed

Open the chart page →

4,251
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

1,755
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
@xmldom/xmldom@0.7.9
xmldom@0.6.0
0.8.15
no fix listed

Open the chart page →

3,159
mod-graphqlfolio-org0.1.301 of 1See more

mod-graphql folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
folioci/mod-graphql:latestf0655a6a08fd
xmldom@0.6.0
no fix listed

Open the chart page →

1,091
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
xmldom@0.3.0
no fix listed
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
xmldom@0.3.0
no fix listed

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
xmldom@0.1.27
no fix listed

Open the chart page →

8,213
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,769
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

2,538
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
@xmldom/xmldom@0.7.5
xmldom@0.1.31
0.8.15
no fix listed

Open the chart page →

4,253
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,014
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
xmldom@0.1.27
no fix listed

Open the chart page →

7,232
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,826
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
xmldom@0.1.27
no fix listed

Open the chart page →

4,614
sqlpadkronkltdVerified publisher0.1.01 of 1See more

sqlpad kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
sqlpad/sqlpad:6.7d3d2f430dffd
xmldom@0.5.0
no fix listed

Open the chart page →

3,397
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

5,410
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

9,668
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
xmldom@0.3.0
no fix listed

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
xmldom@0.3.0
no fix listed

Open the chart page →

7,027
monocularmonocular1.4.152 of 5See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
xmldom@0.1.27
no fix listed
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
xmldom@0.1.27
no fix listed

Open the chart page →

7,048
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
xmldom@0.4.0
no fix listed

Open the chart page →

27,465
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-83616.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,219

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
@xmldom/xmldom@0.9.6
0.9.12
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
xmldom@0.1.31
no fix listed
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
xmldom@0.1.31
no fix listed
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@xmldom/xmldom@0.8.10
0.8.15
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
@xmldom/xmldom@0.8.11
0.8.15
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
@xmldom/xmldom@0.8.13
0.8.15
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
xmldom@0.1.31
0.8.15
no fix listed
1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
xmldom@0.1.27
no fix listed
1
quay.io/wekan/wekan:v5.65cb17600883a3
xmldom@0.1.19
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.