StackRadar

CVE-2026-83619

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
48
of 17,781 indexed, latest versions
Container images
38
deployed by those charts
Fix available
1 of 1
affected package

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Carried by container images the latest versions of 48 of 17,781 indexed charts deploy, on 38 images.

Affected packageAffected versionsFixed inImages
@xmldom/xmldomnpm0.7.5, 0.7.9, 0.8.6, 0.8.10+4 more0.8.1538
OSV records
GHSA-x4fp-j954-r2f4

Charts affected

48 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.401 of 1See more

n8n community-charts 1.24.40

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

772
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,352
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,639
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

2,938
n8nhelmforgeVerified publisher2.0.01 of 2See more

n8n helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

863
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,564
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

18,517
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
@xmldom/xmldom@0.8.6
0.8.15

Open the chart page →

7,776
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

977
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

4,016
predatorzooz1.7.01 of 1See more

predator zooz 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
zooz/predator:1.6f491d1f7a865
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

2,851
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

1,044
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

7,473
keycloak-reporterkeycloak-reporterVerified publisher1.4.151 of 1See more

keycloak-reporter keycloak-reporter 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,322
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,575
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

31,844
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,833
decisionrules-aksdecisionrules-aksVerified publisher0.2.01 of 2See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-eksdecisionrules-eksVerified publisher0.3.01 of 2See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ingressdecisionrules-ingressVerified publisher0.2.01 of 2See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

1,138
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

2,685
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,551
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

1,755
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
@xmldom/xmldom@0.7.9
0.8.15

Open the chart page →

3,159
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,769
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
@xmldom/xmldom@0.8.11
0.8.15

Open the chart page →

2,538
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

4,253
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,014
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

5,826
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

5,410
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

9,668
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

4,219
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

1,038
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

895
rybbitrybbit-helm1.3.01 of 7See more

rybbit rybbit-helm 1.3.0

1 of the 7 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,819
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

3,118
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15

Open the chart page →

2,638
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

3,014
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
samajh/alprfrontend:latest05ef4fddbb75
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

20,270
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,535
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,550
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

2,028
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
@xmldom/xmldom@0.8.10
0.8.15

Open the chart page →

2,789
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
@xmldom/xmldom@0.8.12
0.8.15

Open the chart page →

2,076
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
0.8.15

Open the chart page →

3,118
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-83619.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
@xmldom/xmldom@0.8.13
0.8.15

Open the chart page →

5,459

Container images carrying it

38 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
decisionrules/server:latestf38d8571fa06
@xmldom/xmldom@0.8.13
0.8.15
4
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
@xmldom/xmldom@0.8.14
0.8.15
3
infisical/infisical:latest:v0.165.602082bf13163
@xmldom/xmldom@0.8.13
0.8.15
2
n8nio/n8n:2.36.714c4285bc303
@xmldom/xmldom@0.8.14
0.8.15
2
n8nio/n8n:2.38.45d9f0cc5672b
@xmldom/xmldom@0.8.14
0.8.15
2
requarks/wiki:2:latest68f0d1848261
@xmldom/xmldom@0.8.13
0.8.15
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
@xmldom/xmldom@0.7.5
0.8.15
2
automatischio/automatisch:0.15.03bace7a12d5f
@xmldom/xmldom@0.8.10
0.8.15
1
continuoussecuritytooling/keycloak-reporting-cli:1.3.3f04ecefab64e
@xmldom/xmldom@0.8.13
0.8.15
1
directus/directus:12.0.29c8470ea465c
@xmldom/xmldom@0.8.13
0.8.15
1
directus/directus:11.1.0e3c8bb975350
@xmldom/xmldom@0.8.10
0.8.15
1
docmost/docmost:0.95.041c8d777cf23
@xmldom/xmldom@0.8.13
0.8.15
1
enketo/enketo-express:3.0.4dcad9c2273f6
@xmldom/xmldom@0.7.5
0.8.15
1
etherpad/etherpad:latest6020e7b57f4b
@xmldom/xmldom@0.8.13
0.8.15
1
fiware/idm:8.3.3a1b6ed4ae84f
@xmldom/xmldom@0.7.9
0.8.15
1
joplin/server:latest3f7b852959aa
@xmldom/xmldom@0.8.13
0.8.15
1
n8nio/n8n:2.25.7761374d4eb84
@xmldom/xmldom@0.8.13
0.8.15
1
n8nio/n8n:1.86.08b39ed5a2de9
@xmldom/xmldom@0.8.10
0.8.15
1
n8nio/n8n:0.212.0a9195bc499a3
@xmldom/xmldom@0.8.6
0.8.15
1
n8nio/n8n:2.36.8cfe2704ff858
@xmldom/xmldom@0.8.14
0.8.15
1
n8nio/n8n:1.33.1dd171d45102a
@xmldom/xmldom@0.8.10
0.8.15
1
nocodb/nocodb:0.258.06779a4ddedf2
@xmldom/xmldom@0.8.10
0.8.15
1
nocodb/nocodb:0.301.5d9516f0bf546
@xmldom/xmldom@0.8.11
0.8.15
1
outlinewiki/outline:0.82.0494dfb9249a6
@xmldom/xmldom@0.8.10
0.8.15
1
requarks/wiki:canary-2.5.2438b5865a7386c
@xmldom/xmldom@0.7.5
0.8.15
1
samajh/alprfrontend:latest05ef4fddbb75
@xmldom/xmldom@0.7.5
0.8.15
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@xmldom/xmldom@0.7.5
0.8.15
1
treskon/portrait-ui:DEV-lateste7970783bc8d
@xmldom/xmldom@0.8.10
0.8.15
1
twentycrm/twenty:v2.22.0e7d9948bf284
@xmldom/xmldom@0.8.13
0.8.15
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
@xmldom/xmldom@0.8.10
0.8.15
1
zooz/predator:1.6f491d1f7a865
@xmldom/xmldom@0.7.5
0.8.15
1
ghcr.io/ajnart/homarr:lateste103abadfb52
@xmldom/xmldom@0.8.10
0.8.15
1
ghcr.io/colanode/server:latest7006cac874fd
@xmldom/xmldom@0.8.12
0.8.15
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
@xmldom/xmldom@0.8.10
0.8.15
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
@xmldom/xmldom@0.8.11
0.8.15
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
@xmldom/xmldom@0.8.13
0.8.15
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
@xmldom/xmldom@0.8.12
0.8.15
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
@xmldom/xmldom@0.8.12
0.8.15
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.