StackRadar

CVE-2026-87859

Medium

Advisory

Published 28 Sept 2026In the index since 29 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
90
of 17,957 indexed, latest versions
Container images
89
deployed by those charts
Fix available
1 of 1
affected package

morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

Carried by container images the latest versions of 90 of 17,957 indexed charts deploy, on 89 images.

Affected packageAffected versionsFixed inImages
morgannpm1.6.1, 1.7.0, 1.9.0, 1.9.1+4 more1.12.189
OSV records
GHSA-9f6g-j8ch-79g4

Charts affected

90 by stars
ChartLatestAffected imagesRadar Score
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.12.1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.12.1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.12.1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.12.1

Open the chart page →

91,279
nodeapphelmcharts0.1.41 of 1See more

nodeapp helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
kaushaln1/helm_node_app:lateste9f2d5dfdba0
morgan@1.10.0
1.12.1

Open the chart page →

1,052
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
morgan@1.10.0
1.12.1

Open the chart page →

8,632
automatischhelmforgeVerified publisher1.3.81 of 4See more

automatisch helmforge 1.3.8

1 of the 4 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
morgan@1.10.0
1.12.1

Open the chart page →

5,682
hoppscotchhelmforgeVerified publisher1.1.121 of 2See more

hoppscotch helmforge 1.1.12

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2026.8.2e7ba6061a286
morgan@1.11.0
1.12.1

Open the chart page →

1,911
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
morgan@1.10.1
1.12.1

Open the chart page →

6,121
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
morgan@1.10.0
1.12.1

Open the chart page →

5,125
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
morgan@1.9.1
1.12.1

Open the chart page →

10,967
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
morgan@1.10.0
1.12.1

Open the chart page →

7,619
hello-kubernetes-chartjhidalgo3-githubVerified publisher3.0.01 of 1See more

hello-kubernetes-chart jhidalgo3-github 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
morgan@1.10.0
1.12.1

Open the chart page →

1,020
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
morgan@1.6.1
1.12.1

Open the chart page →

6,656
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.12.1

Open the chart page →

1,115
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.12.1

Open the chart page →

1,823
kubevious-agentkubevious1.0.41 of 1See more

kubevious-agent kubevious 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
kubevious/parser:1.0.151acf1a1f0b47
morgan@1.10.0
1.12.1

Open the chart page →

2,031
workload-operatorkubevious0.0.31 of 1See more

workload-operator kubevious 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
kubevious/workload-operator:1.0.20b0f4c507eb6
morgan@1.10.0
1.12.1

Open the chart page →

2,109
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.12.1

Open the chart page →

10,534
littlelink-servermhamzahkhanVerified publisher1.0.01 of 1See more

littlelink-server mhamzahkhan 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.12.1

Open the chart page →

940
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
library/mongo-express:latest1b23d7976f02
morgan@1.10.0
1.12.1

Open the chart page →

5,474
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
morgan@1.10.0
1.12.1

Open the chart page →

4,756
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
morgan@1.10.0
1.12.1

Open the chart page →

3,377
smilencsaVerified publisher1.1.02 of 23See more

smile ncsa 1.1.0

2 of the 23 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
morgan@1.7.0
1.12.1
socialmediamacroscope/smile_server:0.3.31a528c794270
morgan@1.9.1
1.12.1

Open the chart page →

295,100
node-hostnamenode-hostnameVerified publisher1.0.11 of 1See more

node-hostname node-hostname 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
christianhuth/node-hostname:1.0.1c07f414a3e4b
morgan@1.9.1
1.12.1

Open the chart page →

1,141
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
morgan@1.10.0
1.12.1

Open the chart page →

27,908
example-idpory0.64.01 of 1See more

example-idp ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
oryd/hydra-login-consent-node:v26.2.06465e95993b5
morgan@1.10.0
1.12.1

Open the chart page →

1,098
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
morgan@1.9.1
1.12.1

Open the chart page →

6,653
claude-relayrevolution10.1.371 of 4See more

claude-relay revolution1 0.1.37

1 of the 4 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.12.1

Open the chart page →

5,168
jsonplaceholderrgnu1.0.01 of 1See more

jsonplaceholder rgnu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
svenwal/jsonplaceholder:latestba2f285af432
morgan@1.10.0
1.12.1

Open the chart page →

1,601
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
morgan@1.9.1
1.12.1

Open the chart page →

5,441
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
library/mongo-express:1.0.2-20-alpine3.191aae00775251
morgan@1.10.0
1.12.1

Open the chart page →

2,136
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
morgan@1.10.0
1.12.1

Open the chart page →

3,278
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.12.1

Open the chart page →

3,833
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.089bd85d7817f
morgan@1.11.0
1.12.1

Open the chart page →

3,131
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
morgan@1.10.0
1.12.1

Open the chart page →

4,023
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
morgan@1.10.1
1.12.1

Open the chart page →

4,555
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
morgan@1.10.0
1.12.1

Open the chart page →

3,698
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.12.1

Open the chart page →

5,256
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
morgan@1.10.0
1.12.1

Open the chart page →

3,255
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
morgan@1.10.0
1.12.1

Open the chart page →

3,278
workadventure-adminwork-adventure1.0.0-21-31 of 14See more

workadventure-admin work-adventure 1.0.0-21-3

1 of the 14 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
morgan@1.10.0
1.12.1

Open the chart page →

16,183
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry CVE-2026-87859.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.12.1

Open the chart page →

16,476

Container images carrying it

89 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
stanfordoval/almond-server:latest1a63cdccedaf
morgan@1.10.0
1.12.1
1
svenwal/jsonplaceholder:latestba2f285af432
morgan@1.10.0
1.12.1
1
tensorzero/ui:2026.6.0f2563d54724e
morgan@1.10.1
1.12.1
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
morgan@1.10.0
1.12.1
1
thecodingmachine/workadventure-uploader:helm-chart962e98843fb2
morgan@1.10.0
1.12.1
1
treskon/portrait-ui:DEV-lateste7970783bc8d
morgan@1.9.1
1.12.1
1
vcnngr/pnbackend:latesteaf44ad0ad1f
morgan@1.10.1
1.12.1
1
wekanteam/wekan:v4.2268a51f0327df
morgan@1.6.1
1.12.1
1
wiremind/scrapoxy:lateste7048929a676
morgan@1.9.1
1.12.1
1
zazuko/trifid:2.3.7054be137de70
morgan@1.10.0
1.12.1
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
morgan@1.10.0
1.12.1
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
morgan@1.10.1
1.12.1
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
morgan@1.12.0
1.12.1
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
morgan@1.10.1
1.12.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
morgan@1.9.1
1.12.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
morgan@1.9.1
1.12.1
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
morgan@1.10.0
1.12.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
morgan@1.10.0
1.12.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
morgan@1.10.0
1.12.1
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
morgan@1.10.1
1.12.1
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
morgan@1.10.1
1.12.1
1
ghcr.io/linuxserver/clarkson:version-v1.1.21aa4cce28728
morgan@1.9.1
1.12.1
1
ghcr.io/linuxserver/hedgedoc:version-1.9.0792a12ee976a
morgan@1.10.0
1.12.1
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
morgan@1.10.0
1.12.1
1
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
morgan@1.10.0
1.12.1
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
morgan@1.10.0
1.12.1
1
ghcr.io/techno-tim/littlelink-server:latest735a1fcd078b
morgan@1.10.0
1.12.1
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
morgan@1.10.1
1.12.1
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
morgan@1.10.1
1.12.1
1
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
morgan@1.10.0
1.12.1
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
morgan@1.11.0
1.12.1
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
morgan@1.9.1
1.12.1
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
morgan@1.10.1
1.12.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
morgan@1.6.1
1.12.1
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
morgan@1.11.0
1.12.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
morgan@1.10.0
1.12.1
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
morgan@1.9.0
1.12.1
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.