StackRadar

CVE-2026-9358

Medium

Advisory

Published 24 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
366
of 17,781 indexed, latest versions
Container images
379
deployed by those charts
Fix available
1 of 2
affected packages

postcss-selector-parser allows denial of service through uncontrolled AST recursion

Carried by container images the latest versions of 366 of 17,781 indexed charts deploy, on 379 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm6.1.0, 6.1.1, 6.1.2, 7.1.0+2 more6.1.3, 7.1.3378
node-css-loaderdeb6.8.1+~cs14.0.17-1no fix listed1
OSV records
GHSA-w9m9-85wc-3x92UBUNTU-CVE-2026-9358

Charts affected

366 by stars
ChartLatestAffected imagesRadar Score
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
postcss-selector-parser@7.1.0
7.1.3

Open the chart page →

4,661
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
postcss-selector-parser@6.1.2
6.1.3
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
postcss-selector-parser@6.1.2
6.1.3
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

6,994
altinnendata-apptumogroup0.1.141 of 1See more

altinnendata-app tumogroup 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sondresjo/altinnendata-app:v1.8.011ead455b492
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

1,833
nstuning-apptumogroup0.1.171 of 1See more

nstuning-app tumogroup 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sondresjo/nstuning-app:v1.6.10ffca294f10ba
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

1,842
homepageunknowniq1.8.81 of 2See more

homepage unknowniq 1.8.8

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.2.0753eeb0cc22a
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

352
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
postcss-selector-parser@6.1.0
6.1.3

Open the chart page →

2,620
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

5,228
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
postcss-selector-parser@6.1.0
6.1.3

Open the chart page →

4,768
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

1,787
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

4,305
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

2,076
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

5,984
apisix-ingress-controllerwenerme1.3.11 of 2See more

apisix-ingress-controller wenerme 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

1,616
verdacciowenerme4.35.11 of 1See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

215
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

5,459

Container images carrying it

379 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/appscode/platform-ui:2.4.0668ee2682eaf
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/argonix-io/argonix-api-frontend:1.0.0b6a67099e4c5
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/bluesky-social/pds:0.4.208637083d9369d
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/bryopsida/openmct:main38b6a50a62b2
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/bryopsida/psa-restricted-patcher:maina53ef16b024a
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/bryopsida/syslog-portal:main3947bfd04f49
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/calesthio/crucix:latest67c5244b6acf
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/caninehq/canine:latesta058034ca006
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/cross-seed/cross-seed:6.13.7a1fed512261f
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/curium-rocks/k8s-jacoco-operator:maina558ceae6cdb
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/data-fair/notify:3c739b74dabb0
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/duyet/clickhouse-monitoring:latest84edfe8a67a8
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
postcss-selector-parser@6.1.2
6.1.3
1
ghcr.io/firecrawl/firecrawl:2.11.33092ee28c20a0d
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/firecrawl/playwright-service:latest1f6eba640320
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/fpsacha/zomboid-panel:v1.0.6605e16dd56cfb
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/gethomepage/homepage:v2.3.0f82027665453
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
postcss-selector-parser@6.1.0
6.1.3
1
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
postcss-selector-parser@7.1.1
7.1.3
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
postcss-selector-parser@7.1.0
7.1.3
1
ghcr.io/jeboehm/fetchmailmgr:0.3.2126c4691b28a4
postcss-selector-parser@7.1.0
7.1.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.