StackRadar

CVE-2026-8643

High

Advisory

Published 1 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.0
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,273
of 17,787 indexed, latest versions
Container images
1,223
deployed by those charts
Fix available
1 of 2
affected packages

pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory

Carried by container images the latest versions of 1,273 of 17,787 indexed charts deploy, on 1,223 images.

Affected packageAffected versionsFixed inImages
pippypi1.5.4, 8.1.1, 8.1.2, 9.0.0+67 more26.1.21,216
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+24 moreno fix listed139
OSV records
GHSA-wf93-45jw-7689UBUNTU-CVE-2026-8643DEBIAN-CVE-2026-8643
Also known as
PYSEC-2026-196

Charts affected

1,273 by stars
ChartLatestAffected imagesRadar Score
phonebook-chartasumankamberoglu0.1.53 of 3See more

phonebook-chart asumankamberoglu 0.1.5

3 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
pip@23.0.1
26.1.2
paulkellerman/resultserver-app:1.0381eeccb0618
pip@22.3
26.1.2
paulkellerman/webserver-app:latest5a37b74f61b9
pip@22.3
26.1.2

Open the chart page →

3,176
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
pip@23.3.2
26.1.2

Open the chart page →

9,412
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
pip@21.2.4
26.1.2

Open the chart page →

5,507
botkubeaveshaVerified publisher1.0.01 of 2See more

botkube avesha 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/kubeshop/k8s-sidecar:ignore-initial-events7f583a36a764
pip@22.2.2
26.1.2

Open the chart page →

5,074
aws-ecr-credentialaws-ecr-credentialVerified publisher1.5.21 of 1See more

aws-ecr-credential aws-ecr-credential 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
architectminds/aws-kubectl:1.19735e59a1085
pip@19.2.1
26.1.2

Open the chart page →

1,437
ecr-exporteraws-exportersVerified publisher0.2.41 of 1See more

ecr-exporter aws-exporters 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/aws-exporters/prometheus-ecr-exporter:0.1.442b0c87470d6
pip@20.3.4
26.1.2

Open the chart page →

1,622
inspector-exporteraws-exportersVerified publisher0.0.21 of 1See more

inspector-exporter aws-exporters 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/aws-exporters/prometheus-inspector-exporter:0.0.29c7c11293b3c
pip@20.3.4
26.1.2

Open the chart page →

1,622
aws-secrets-synchronizeraws-secrets-synchronizer0.2.11 of 1See more

aws-secrets-synchronizer aws-secrets-synchronizer 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/reezogit/aws-secrets-synchronizer:0.2.1111ed7cf7b39
pip@23.2.1
26.1.2

Open the chart page →

956
axosyslog-collectoraxosyslogVerified publisher0.8.11 of 1See more

axosyslog-collector axosyslog 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/axoflow/axosyslog:4.5.0aa7831e207cd
pip@23.3.1
26.1.2

Open the chart page →

1,516
azure-advanced-backupazure-advanced-backup0.4.11 of 1See more

azure-advanced-backup azure-advanced-backup 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-advanced-backup:0.4.01041d4449e49
pip@22.0.4
26.1.2

Open the chart page →

4,568
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
pip@21.2.4
26.1.2

Open the chart page →

1,790
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
pip@20.2.4
26.1.2

Open the chart page →

5,521
aks-helloworldazure-sample0.1.11 of 1See more

aks-helloworld azure-sample 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/aks-helloworld:v1fb47732ef36b
pip@9.0.1
26.1.2

Open the chart page →

4,269
azure-voteazure-sample0.1.11 of 2See more

azure-vote azure-sample 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
pip@9.0.1
26.1.2

Open the chart page →

5,224
azure-vote-osbaazure-sample0.1.01 of 1See more

azure-vote-osba azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/azure-vote-front:v384062718347c
pip@9.0.1
26.1.2

Open the chart page →

4,269
osba-container-instances-demoazure-sample0.1.01 of 1See more

osba-container-instances-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/osba-container-instances-demo:latest6527b05d5d03
pip@9.0.1
26.1.2

Open the chart page →

3,212
osba-cosmos-mongodb-demoazure-sample0.1.01 of 1See more

osba-cosmos-mongodb-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/osba-cosmos-mongodb-demo:latestf4940e84ed05
pip@9.0.1
26.1.2

Open the chart page →

2,904
osba-mysql-demoazure-sample0.1.01 of 1See more

osba-mysql-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/osba-mysql-demo:latest5859d68a6c9f
pip@9.0.2
26.1.2

Open the chart page →

2,895
osba-storage-demoazure-sample0.1.01 of 1See more

osba-storage-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/osba-storage-demo:latest29d229ab446e
pip@9.0.1
26.1.2

Open the chart page →

3,425
osba-text-analytics-demoazure-sample0.1.01 of 1See more

osba-text-analytics-demo azure-sample 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/osba-text-analytics-demo:latest969af3cb8466
pip@10.0.1
26.1.2

Open the chart page →

3,089
twitter-sentimentazure-sample0.1.03 of 3See more

twitter-sentiment azure-sample 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
neilpeterson/chart-tweet:latest64fd8dab075f
pip@9.0.1
26.1.2
neilpeterson/get-tweet:v28b645ac1a23e
pip@10.0.1
26.1.2
neilpeterson/process-tweet:latest39ce9f92e899
pip@10.0.1
26.1.2

Open the chart page →

11,833
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
pip@24.0
26.1.2

Open the chart page →

2,738
balance-registrationbalance-registration0.1.01 of 4See more

balance-registration balance-registration 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
conduction/balance-registration-varnish:dev07c44005da9d
pip@9.0.1
26.1.2

Open the chart page →

8,408
pvc-exporterbalihb-pvc-exporterVerified publisher0.2.42 of 2See more

pvc-exporter balihb-pvc-exporter 0.2.4

2 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
balihb/block-pvc-scanner:0.2.45b95e1cf1158
pip@21.2.4
26.1.2
balihb/pod-pvc-mapping:0.2.4ee48e79f5d76
pip@21.2.4
26.1.2

Open the chart page →

2,765
bookinfobasictechno0.1.01 of 6See more

bookinfo basictechno 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
pip@20.1.1
26.1.2

Open the chart page →

20,671
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
pip@26.0.1
26.1.2

Open the chart page →

4,028
wyoming-piperbdclark-helm-chartsVerified publisher0.1.41 of 1See more

wyoming-piper bdclark-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
rhasspy/wyoming-piper:2.5.27d39aafac409
pip@25.1.1
python-pip@25.1.1+dfsg-1
26.1.2
no fix listed

Open the chart page →

1,170
helm-samplebehnambm-helm-chart1.0.12 of 3See more

helm-sample behnambm-helm-chart 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
behnambm/docker-sample:v1bd3ad88afff9
pip@23.0.1
26.1.2
library/mysql:8b3b90af2a655
pip@25.3
26.1.2

Open the chart page →

2,727
pagesberrutig-pages1.0.01 of 3See more

pages berrutig-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,190
mx-nodebicarus-labs0.1.01 of 1See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
bicarus/elrond-rosetta:v1.3.50.0b1dab0721e1c
pip@20.0.2
python-pip@20.0.2-5ubuntu1.6
26.1.2
no fix listed

Open the chart page →

7,956
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
pip@21.1.2
python-pip@9.0.1-2.3~ubuntu1.18.04.5
26.1.2
no fix listed

Open the chart page →

22,891
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
pip@23.0.1
python-pip@23.0.1+dfsg-1
26.1.2
no fix listed

Open the chart page →

10,145
istio-bookinfobookinfo1.2.21 of 6See more

istio-bookinfo bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
pip@19.1.1
26.1.2

Open the chart page →

18,980
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
pip@23.0.1
26.1.2

Open the chart page →

26,996
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.26.2e271016441af
pip@24.0
26.1.2

Open the chart page →

8,323
kube-prometheus-stackbook-k8sinfra-v265.5.11 of 6See more

kube-prometheus-stack book-k8sinfra-v2 65.5.1

1 of the 6 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
kiwigrid/k8s-sidecar:1.28.04166a019eeaf
pip@24.2
26.1.2

Open the chart page →

6,036
puppetboardbootcVerified publisher0.1.41 of 1See more

puppetboard bootc 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
bootc/puppetboard:1.1.0f1383295e7be
pip@19.2.3
26.1.2

Open the chart page →

1,292
flaresolverrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

flaresolverr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
pip@24.0
26.1.2

Open the chart page →

27,274
pagesbrian-pages1.0.01 of 3See more

pages brian-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,190
pagesbrixton-mayuribhavsar23-pages1.0.01 of 3See more

pages brixton-mayuribhavsar23-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,190
pagesbrixton-pages1.0.01 of 3See more

pages brixton-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,190
couchpotatobryanalves0.3.01 of 1See more

couchpotato bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
pip@19.3.1
26.1.2

Open the chart page →

2,018
medusabryanalves0.1.01 of 1See more

medusa bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
linuxserver/medusa:v0.3.9-ls340a5f5114128b
pip@19.2.3
26.1.2

Open the chart page →

147
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
pip@19.3.1
26.1.2

Open the chart page →

2,504
sickragebryanalves0.1.01 of 1See more

sickrage bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
bryanalves/sickrage:latest42f0a130001d
pip@9.0.0
26.1.2

Open the chart page →

923
frigatebryopsida0.2.11 of 2See more

frigate bryopsida 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.11.18330b0a265b8
pip@20.3.4
26.1.2

Open the chart page →

2,573
pagescamden-pages1.0.01 of 3See more

pages camden-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
pip@25.3
26.1.2

Open the chart page →

20,190
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
pip@22.0.4
26.1.2

Open the chart page →

2,507
bucket-clonercamptocamp31.0.41 of 1See more

bucket-cloner camptocamp3 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
camptocamp/bucket-cloner:latestacfafc308d88
pip@21.2.1
26.1.2

Open the chart page →

4,518
ekorrecamptocamp30.1.11 of 1See more

ekorre camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-8643.

Container imageDigestPackageFixed in
camptocamp/ekorre:0.1.035c91d5fda04
pip@20.0.2
26.1.2

Open the chart page →

3,891

Container images carrying it

1,223 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
langgenius/dify-api:0.6.11fca918260dd6
pip@23.0.1
26.1.2
1
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
langgenius/dify-plugin-daemon:main-localda995c129e2f
pip@24.0
python-pip@24.0+dfsg-1ubuntu1.3
26.1.2
no fix listed
1
langgenius/dify-sandbox:0.2.124e65e8a351a2
pip@23.0.1
26.1.2
1
langgenius/dify-sandbox:0.2.15750e1111426e
pip@26.0.1
26.1.2
1
lib42/deluge:20c4d1d326f95
pip@22.3.1
26.1.2
1
library/crate:4.7.0c7984a05e15b
pip@9.0.3
26.1.2
1
library/mysql:8.4.113466ba4a4828
pip@25.3
26.1.2
1
library/mysql:885b9bf2e29cf
pip@25.3
26.1.2
1
library/mysql:8.4.108dbcf531a03a
pip@25.3
26.1.2
1
library/mysql:8.0.41bf577825b52a
pip@24.2
26.1.2
1
library/python:3.8-alpine3d93b1f77efc
pip@23.0.1
26.1.2
1
library/python:3.1070c9cc675605
pip@23.0.1
26.1.2
1
library/python:3.11-slim9534e5a8e315
pip@24.0
26.1.2
1
library/python:3.12-alpineb64631e04e49
pip@25.0.1
26.1.2
1
library/python:3.8d41127070014
pip@23.0.1
26.1.2
1
library/python:3.9da5aee29682d
pip@23.0.1
26.1.2
1
library/python:3.12.9-bullseyeed4450bab88f
pip@24.3.1
26.1.2
1
library/python:3.14.3-alpine3.23faee120f7885
pip@25.3
26.1.2
1
librenms/librenms:24.11.00920bc9117a8
pip@24.3.1
26.1.2
1
librenms/librenms:22.4.14f1f3d667cc7
pip@22.0.4
26.1.2
1
libretranslate/libretranslate:v1.9.61de2d7056bb8
pip@24.0
26.1.2
1
linuxserver/babybuddy:1.10.2f7d7c7704249
pip@22.1
26.1.2
1
linuxserver/beets:1.5.0e36d16f7341c
pip@21.3.1
26.1.2
1
linuxserver/calibre-web:0.6.24241009026e6f
pip@25.2
python-pip@24.0+dfsg-1ubuntu1.2
26.1.2
no fix listed
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
pip@21.2.4
26.1.2
1
linuxserver/couchpotato:75e576ee-ls389cd8d5fb1ac
pip@19.0.1
26.1.2
1
linuxserver/couchpotato:75e576ee-ls32c4d2766b9eb7
pip@19.3.1
26.1.2
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
pip@25.1.1
26.1.2
1
linuxserver/healthchecks:version-v1.20.050792a72fc71
pip@21.1.1
26.1.2
1
linuxserver/healthchecks:2.7.2023033194696dab3c50
pip@23.0.1
26.1.2
1
linuxserver/lazylibrarian:version-1152df82f93d2560e233
pip@21.1.2
26.1.2
1
linuxserver/medusa:v0.3.9-ls340a5f5114128b
pip@19.2.3
26.1.2
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
pip@19.3.1
26.1.2
1
linuxserver/yq:3.2.26f5b9586a93e
pip@23.2.1
26.1.2
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pip@26.0.1
26.1.2
1
lmacka/snappass:2.1.293f5c048b7d4
pip@25.0.1
26.1.2
1
lnbitsdocker/lnbits-legend:latest26fae6327477
pip@23.3.1
26.1.2
1
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
pip@23.0.1
26.1.2
1
lncm/specter-desktop:v0.10.4bca14d04397d
pip@20.2.3
26.1.2
1
localstack/localstack:3.19d278167f2b7
pip@23.3.2
26.1.2
1
locustio/locust:2.24.151d866285170
pip@24.0
26.1.2
1
logiqai/toolbox:2.0.155a574ec5b64
pip@18.1
26.1.2
1
louislam/uptime-kuma:1.22.10b55bcb83a1c
pip@18.1
26.1.2
1
louislam/uptime-kuma:13d632903e6af
pip@18.1
26.1.2
1
louislam/uptime-kuma:1.23.1396510915e6be
pip@18.1
26.1.2
1
louislam/uptime-kuma:1.17.1a4eab252e5a2
pip@18.1
26.1.2
1
louislam/uptime-kuma:1.18.5a84767d7934f
pip@18.1
26.1.2
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
pip@18.1
26.1.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.