StackRadar

CVE-2026-9358

Medium

Advisory

Published 24 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.003
25th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
359
of 17,787 indexed, latest versions
Container images
371
deployed by those charts
Fix available
1 of 2
affected packages

postcss-selector-parser allows denial of service through uncontrolled AST recursion

Carried by container images the latest versions of 359 of 17,787 indexed charts deploy, on 371 images.

Affected packageAffected versionsFixed inImages
postcss-selector-parsernpm6.1.0, 6.1.1, 6.1.2, 7.1.0+2 more6.1.3, 7.1.3370
node-css-loaderdeb6.8.1+~cs14.0.17-1no fix listed1
OSV records
GHSA-w9m9-85wc-3x92UBUNTU-CVE-2026-9358

Charts affected

359 by stars
ChartLatestAffected imagesRadar Score
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
postcss-selector-parser@6.1.0
6.1.3

Open the chart page →

4,768
devportalveecode-platform-nextVerified publisher0.1.221See more

devportal veecode-platform-next 0.1.22

1 container image this version deploys carries CVE-2026-9358.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

—
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

4,305
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

2,076
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
postcss-selector-parser@6.1.2
6.1.3

Open the chart page →

5,984
apisix-ingress-controllerwenerme1.3.11 of 2See more

apisix-ingress-controller wenerme 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

1,616
verdacciowenerme4.35.11 of 1See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

215
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-9358.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
postcss-selector-parser@7.1.1
7.1.3

Open the chart page →

5,459

Container images carrying it

371 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_front:4.7.1d7f76c9c65d9
postcss-selector-parser@6.1.0
6.1.3
1
mcr.microsoft.com/azure-storage/azurite:latest830430c1da1a
postcss-selector-parser@7.1.1
7.1.3
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
postcss-selector-parser@7.1.1
7.1.3
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
postcss-selector-parser@6.1.2
6.1.3
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
postcss-selector-parser@6.1.0
6.1.3
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
postcss-selector-parser@6.1.0
6.1.3
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
postcss-selector-parser@7.1.1
7.1.3
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
postcss-selector-parser@7.1.1
7.1.3
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
postcss-selector-parser@7.1.1
7.1.3
1
quay.io/mittwald/kube-mail:latest04f1099241fc
postcss-selector-parser@6.1.0
6.1.3
1
quay.io/seamware/fdsc-dashboard:0.6.0f7706c316c5a
postcss-selector-parser@6.1.0
6.1.3
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
postcss-selector-parser@7.1.1
7.1.3
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
postcss-selector-parser@7.1.1
7.1.3
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
postcss-selector-parser@6.1.2
6.1.3
1
registry.gitlab.com/dyff/dyff-frontend:0.20.152549f52ae53
postcss-selector-parser@6.1.0
6.1.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
postcss-selector-parser@7.1.1
7.1.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
postcss-selector-parser@7.1.1
7.1.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
postcss-selector-parser@7.1.1
7.1.3
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
postcss-selector-parser@7.1.1
7.1.3
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
postcss-selector-parser@7.1.1
7.1.3
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
postcss-selector-parser@6.1.0
6.1.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.