StackRadar

CVE-2026-9358

Medium

Advisory

Published 24 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
366
of 17,781 indexed, latest versions
Container images
379
deployed by those charts
Fix available
1 of 2
affected packages

postcss-selector-parser allows denial of service through uncontrolled AST recursion

Carried by container images the latest versions of 366 of 17,781 indexed charts deploy, on 379 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm6.1.0, 6.1.1, 6.1.2, 7.1.0+2 more6.1.3, 7.1.3378
node-css-loaderdeb6.8.1+~cs14.0.17-1no fix listed1
OSV records
GHSA-w9m9-85wc-3x92UBUNTU-CVE-2026-9358

Charts affected

366 by stars
ChartLatestAffected imagesRadar Score
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
postcss-selector-parser@7.1.0
7.1.3

Open the chart page →

4,661
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
postcss-selector-parser@6.1.2
6.1.3
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
postcss-selector-parser@6.1.2
6.1.3
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

6,994
altinnendata-apptumogroup0.1.141 of 1See more

altinnendata-app tumogroup 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.8.011ead455b492
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

1,833
nstuning-apptumogroup0.1.171 of 1See more

nstuning-app tumogroup 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.10ffca294f10ba
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

1,842
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

352
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
postcss-selector-parser@6.1.0
6.1.3

Open the chart page →

2,620
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

5,228
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
postcss-selector-parser@6.1.0
6.1.3

Open the chart page →

4,768
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

1,787
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

4,305
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

2,076
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

5,984
apisix-ingress-controllerwenerme1.3.11 of 2See more

apisix-ingress-controller wenerme 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

1,616
verdacciowenerme4.35.11 of 1See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

215
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

5,459

Container images carrying it

379 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
postcss-selector-parser@7.1.1
7.1.3
1
globalping/globalping-probe:latest8acbd23009fd
postcss-selector-parser@7.1.1
7.1.3
1
haohanyang/compass-web:0.5.054f2112602ee
postcss-selector-parser@7.1.1
7.1.3
1
hecrom/myweatherprocessingreactclient:1.3.115454b54d5b28
postcss-selector-parser@6.1.0
6.1.3
1
helmforge/strapi-base:5.52.270e9143d6d92
postcss-selector-parser@7.1.1
7.1.3
1
hirosystems/stacks-blockchain-api:8.13.29c98b23c1515
postcss-selector-parser@7.1.0
7.1.3
1
honglab/slack-emoji-maker:v0.0.1ca075a926fe1
postcss-selector-parser@6.1.0
6.1.3
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
postcss-selector-parser@6.1.2
6.1.3
1
ilum/marquez-web:0.53.2716437a51a6c
postcss-selector-parser@7.1.0
7.1.3
1
instill/console:0.68.54cd70e2df5c6
postcss-selector-parser@6.1.0
6.1.3
1
jaedb/iris:latest048cfbf58d57
postcss-selector-parser@6.1.0
6.1.3
1
jesec/flood:4.14.3c887dad96b40
postcss-selector-parser@7.1.1
7.1.3
1
jhidalgo3/hello-kubernetes:1.0.0.1397bf5ddfa8628d79f5
postcss-selector-parser@6.1.0
6.1.3
1
jkroepke/github_exporter:1.8.03d850992786d
postcss-selector-parser@7.1.0
7.1.3
1
johly/airtrail:v3.11.19f702b91e0e7
postcss-selector-parser@7.1.1
7.1.3
1
journeyapps/powersync-service:latestbf46f66e5dcc
postcss-selector-parser@7.1.1
7.1.3
1
jupyterhub/jupyterhub:5.4.63974ba945e65
node-css-loader@6.8.1+~cs14.0.17-1
no fix listed
1
kaushaln1/helm_node_app:lateste9f2d5dfdba0
postcss-selector-parser@6.1.0
6.1.3
1
kitware/cdash:v5.3.0d7767d9b9da4
postcss-selector-parser@6.1.2
6.1.3
1
laly9999/node-app:1dd0e503913e1
postcss-selector-parser@6.1.0
6.1.3
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
postcss-selector-parser@7.1.0
7.1.3
1
langgenius/dify-api:1.16.1dcefa5f7c47c
postcss-selector-parser@7.1.0
7.1.3
1
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
postcss-selector-parser@7.1.1
7.1.3
1
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
postcss-selector-parser@7.1.1
7.1.3
1
langgenius/dify-web:1.16.187dd47e4e28f
postcss-selector-parser@7.1.0
7.1.3
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
postcss-selector-parser@7.1.0
7.1.3
1
langgenius/dify-web:1.0.0d64914ff0d6d
postcss-selector-parser@6.1.0
6.1.3
1
lbenicio/helm-pilot:0.2.54594a2632510
postcss-selector-parser@7.1.1
7.1.3
1
lbenicio/stremio-web:latest732f9003de33
postcss-selector-parser@7.1.1
7.1.3
1
leonardomulticloud/svc-vault-frontend:v1.0.0e42a341e0299
postcss-selector-parser@6.1.2
6.1.3
1
library/ghost:6.37.01ef2e532ca4d
postcss-selector-parser@7.1.1
7.1.3
1
library/ghost:6.25.12654b1e90413
postcss-selector-parser@7.1.1
7.1.3
1
library/ghost:6.41.129773d6be407
postcss-selector-parser@7.1.1
7.1.3
1
library/ghost:6.39.0-alpine77196da4b0df
postcss-selector-parser@7.1.1
7.1.3
1
library/ghost:6.62.0a7a268bbfb7f
postcss-selector-parser@7.1.1
7.1.3
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
postcss-selector-parser@7.1.0
7.1.3
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
postcss-selector-parser@6.1.0
6.1.3
1
library/node:22-bookworm-slim83f487e0a634
postcss-selector-parser@7.1.1
7.1.3
1
library/node:18-alpine8d6421d663b4
postcss-selector-parser@6.1.0
6.1.3
1
library/node:208f693eaa7e0a
postcss-selector-parser@6.1.0
6.1.3
1
lissy93/domain-locker:latestd3c95edc0a8b
postcss-selector-parser@6.1.0
6.1.3
1
lissy93/networking-toolbox:latest700862839553
postcss-selector-parser@7.1.0
7.1.3
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
postcss-selector-parser@7.1.1
7.1.3
1
litlyx/litlyx-consumer:latest02225e77d316
postcss-selector-parser@7.1.0
7.1.3
1
litlyx/litlyx-dashboard:lateste64ff2d52385
postcss-selector-parser@7.1.0
7.1.3
1
litlyx/litlyx-producer:latest10407f36613f
postcss-selector-parser@7.1.0
7.1.3
1
louislam/uptime-kuma:2.2.1-slim059b49d64739
postcss-selector-parser@7.1.0
7.1.3
1
louislam/uptime-kuma:2.5.33e24e96c89ef
postcss-selector-parser@7.1.1
7.1.3
1
louislam/uptime-kuma:2.0.24c364ef96aad
postcss-selector-parser@6.1.0
6.1.3
1
louislam/uptime-kuma:2.4.091e963bfda56
postcss-selector-parser@7.1.1
7.1.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.