StackRadar

CVE-2026-87859

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
90
of 17,957 indexed, latest versions
Container images
89
deployed by those charts
Fix available
1 of 1
affected package

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Carried by container images the latest versions of 90 of 17,957 indexed charts deploy, on 89 images.

Affected packageAffected versionsFixed inImages
morgannpm1.6.1, 1.7.0, 1.9.0, 1.9.1+4 more1.12.189
OSV records
GHSA-9f6g-j8ch-79g4

Charts affected

90 by stars
ChartLatestAffected imagesRadar Score
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
morgan@1.10.0
1.12.1

Open the chart page →

1,312
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
morgan@1.10.0
1.12.1

Open the chart page →

7,734
hedgedocadfinisVerified publisher0.6.11 of 2See more

hedgedoc adfinis 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
morgan@1.11.0
1.12.1

Open the chart page →

3,434
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
morgan@1.10.1
1.12.1

Open the chart page →

31,338
hedgedocnicholaswildeVerified publisher1.1.01 of 1See more

hedgedoc nicholaswilde 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/hedgedoc:version-1.9.0792a12ee976a
morgan@1.10.0
1.12.1

Open the chart page →

13,133
lighthouse-cicowboysysopVerified publisher9.0.01 of 1See more

lighthouse-ci cowboysysop 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
patrickhulce/lhci-server:0.8.174b4b6a3954d
morgan@1.10.0
1.12.1

Open the chart page →

2,282
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
morgan@1.10.0
1.12.1

Open the chart page →

8,632
open5gsopen5gsVerified publisher2.3.51 of 5See more

open5gs open5gs 2.3.5

1 of the 5 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
morgan@1.10.0
1.12.1

Open the chart page →

9,492
kongakonga1.1.01 of 1See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.1

Open the chart page →

5,309
kubeviouskubevious1.2.24 of 7See more

kubevious kubevious 1.2.2

4 of the 7 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
kubevious/backend:1.2.22d9ba6eb46b6
morgan@1.10.0
1.12.1
kubevious/collector:1.2.1f58226f9d84e
morgan@1.10.0
1.12.1
kubevious/guard:1.2.19bf567704de2
morgan@1.10.0
1.12.1
kubevious/parser:1.2.299ae7a5168c2
morgan@1.10.0
1.12.1

Open the chart page →

14,670
kobotoolboxone-acre-fundVerified publisher0.7.41 of 9See more

kobotoolbox one-acre-fund 0.7.4

1 of the 9 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
morgan@1.10.0
1.12.1

Open the chart page →

19,988
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
morgan@1.11.0
1.12.1

Open the chart page →

1,242
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.12.1

Open the chart page →

1,234
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.12.1

Open the chart page →

75,874
enbuildenbuildVerified publisher0.0.501 of 6See more

enbuild enbuild 0.0.50

1 of the 6 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.12.1

Open the chart page →

33,660
ranetogabisonfire0.1.21 of 1See more

raneto gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.12.1

Open the chart page →

2,623
zwavejs2mqttgeek-cookbookVerified publisher5.4.21 of 1See more

zwavejs2mqtt geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.12.1

Open the chart page →

3,573
lifecycle-jira-integrationlifecycle-jira-integration1.0.01 of 1See more

lifecycle-jira-integration lifecycle-jira-integration 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
anoopnair/lifecycle-jira-integration:latestd80c73a6089d
morgan@1.10.0
1.12.1

Open the chart page →

979
plane-enterprisemakeplaneOfficialVerified publisher3.10.11 of 13See more

plane-enterprise makeplane 3.10.1

1 of the 13 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
makeplane/space-commercial:v3.3.03dba6a659fb9
morgan@1.12.0
1.12.1

Open the chart page →

4,114
clarksonnicholaswildeVerified publisher0.2.31 of 1See more

clarkson nicholaswilde 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/clarkson:version-v1.1.21aa4cce28728
morgan@1.9.1
1.12.1

Open the chart page →

577
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
gradiant/open5gs-webui:2.7.5fbd10c017541
morgan@1.10.0
1.12.1

Open the chart page →

5,410
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.12.1

Open the chart page →

7,385
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
morgan@1.10.1
1.12.1

Open the chart page →

7,918
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.12.1

Open the chart page →

33,687
scrapoxywiremindVerified publisher0.3.41 of 1See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.12.1

Open the chart page →

2,224
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.12.1

Open the chart page →

108,044
admin-portaladmin-web-portal1.2.11 of 2See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
soulou2019/node-server:latest5e6ecfcc109e
morgan@1.10.0
1.12.1

Open the chart page →

3,485
lhciadnoctemVerified publisher0.1.01 of 1See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
morgan@1.12.0
1.12.1

Open the chart page →

1,481
openhab-cloudandibraeuVerified publisher1.2.61 of 1See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
openhab/openhab-cloud:a8138a329dd2bac8c4b
morgan@1.10.0
1.12.1

Open the chart page →

3,567
trifidappuio2.0.21 of 1See more

trifid appuio 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.12.1

Open the chart page →

2,870
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.1

Open the chart page →

93,324
http-debugbicarus-labs0.1.01 of 1See more

http-debug bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
bicarus/http-https-echo:2785dd6a7e805e
morgan@1.10.0
1.12.1

Open the chart page →

918
registry-uibryanalves0.2.01 of 1See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
konradkleine/docker-registry-frontend:v2181aad54ee64
morgan@1.6.1
1.12.1

Open the chart page →

4,159
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad3 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.12.1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.12.1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.12.1

Open the chart page →

19,408
stocksalescluster-deploy0.1.31 of 1See more

stocksales cluster-deploy 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
foggbh/stocky:latest8b7a2e5ecf4e
morgan@1.10.1
1.12.1

Open the chart page →

551
cors-proxycors-proxyVerified publisher1.2.01 of 1See more

cors-proxy cors-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.12.1

Open the chart page →

1,739
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
morgan@1.6.1
1.12.1

Open the chart page →

5,309
azuriteemberstackVerified publisher1.0.211 of 1See more

azurite emberstack 1.0.21

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
morgan@1.11.0
1.12.1

Open the chart page →

473
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.12.1

Open the chart page →

1,992
smeejasfanzynoodle0.0.11 of 1See more

smeejas fanzynoodle 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
fanzynoodle/smeejas:0.0.15f9916c1a287
morgan@1.10.0
1.12.1

Open the chart page →

4,833
consent-managerfiware0.1.21 of 1See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/wi_stefan/consent-manager:0.0.656399619568b
morgan@1.11.0
1.12.1

Open the chart page →

2,163
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
morgan@1.10.0
1.12.1

Open the chart page →

3,362
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.12.1

Open the chart page →

6,187
galoy-paygaloymoney0.11.481 of 2See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
morgan@1.10.0
1.12.1

Open the chart page →

2,595
galoy-paygaloymoney20.11.481 of 2See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
morgan@1.10.0
1.12.1

Open the chart page →

2,595
littlelink-servergeek-cookbookVerified publisher1.4.21 of 1See more

littlelink-server geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
morgan@1.10.0
1.12.1

Open the chart page →

872
littlelink-serverh2mVerified publisher1.0.11 of 1See more

littlelink-server h2m 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:lateste84ea9d93b60
morgan@1.10.0
1.12.1

Open the chart page →

872
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
morgan@1.10.0
1.12.1

Open the chart page →

1,841
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
morgan@1.10.0
1.12.1

Open the chart page →

3,075
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.12.1

Open the chart page →

24,679

Container images carrying it

89 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
stanfordoval/almond-server:latest1a63cdccedaf
morgan@1.10.0
1.12.1
1
svenwal/jsonplaceholder:latestba2f285af432
morgan@1.10.0
1.12.1
1
tensorzero/ui:2026.6.0f2563d54724e
morgan@1.10.1
1.12.1
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.12.1
1
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
morgan@1.10.0
1.12.1
1
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.12.1
1
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.12.1
1
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.12.1
1
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.12.1
1
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.12.1
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.12.1
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.12.1
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
morgan@1.12.0
1.12.1
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.12.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.12.1
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.12.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.12.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.12.1
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.12.1
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
morgan@1.10.1
1.12.1
1
ghcr.io/linuxserver/clarkson:version-v1.1.21aa4cce28728
morgan@1.9.1
1.12.1
1
ghcr.io/linuxserver/hedgedoc:version-1.9.0792a12ee976a
morgan@1.10.0
1.12.1
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.12.1
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.12.1
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.12.1
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.12.1
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.12.1
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.12.1
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.12.1
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
morgan@1.11.0
1.12.1
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.12.1
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.12.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.12.1
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
morgan@1.11.0
1.12.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.12.1
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.12.1
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.