StackRadar

CVE-2026-93981

Medium

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
4.7
base score, highest
EPSS
0.002
12th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
44
of 17,966 indexed, latest versions
Container images
46
deployed by those charts
Fix available
1 of 1
affected package

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Carried by container images the latest versions of 44 of 17,966 indexed charts deploy, on 46 images.

Affected packageAffected versionsFixed inImages
hononpm4.6.12, 4.7.11, 4.10.4, 4.11.4+20 more4.13.746
OSV records
GHSA-hxh3-vqpv-xpqv

Charts affected

44 by stars
ChartLatestAffected imagesRadar Score
n8ncommunity-chartsVerified publisher1.24.421 of 1See more

n8n community-charts 1.24.42

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.40.59f693fd55655
hono@4.12.34
4.13.7

Open the chart page →

1,230
n8nopen-8gears2.1.11 of 1See more

n8n open-8gears 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.7

Open the chart page →

1,595
rocketchatrocketchat-server7.0.24 of 12See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.7
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.7
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.7
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.7

Open the chart page →

13,049
penpotpenpotOfficialVerified publisher1.10.01 of 5See more

penpot penpot 1.10.0

1 of the 5 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
penpotapp/mcp:2.18.09270da9fab95
hono@4.13.5
4.13.7

Open the chart page →

5,947
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.7

Open the chart page →

6,458
n8nhelmforgeVerified publisher2.1.21 of 2See more

n8n helmforge 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.41.3fdce8f852ac7
hono@4.12.34
4.13.7

Open the chart page →

1,443
docmosthelmforgeVerified publisher1.4.01 of 4See more

docmost helmforge 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
docmost/docmost:0.96.0b56947fcfd08
hono@4.12.34
4.13.7

Open the chart page →

4,260
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.13.7

Open the chart page →

11,108
ghostcloudpirates-ghostVerified publisher0.20.261 of 3See more

ghost cloudpirates-ghost 0.20.26

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
library/ghost:6.64.0586821cfebac
hono@4.12.18
4.13.7

Open the chart page →

7,893
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.13.7

Open the chart page →

31,649
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher1.1.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 1.1.2

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
hono@4.12.18
4.13.7

Open the chart page →

1,965
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.7

Open the chart page →

4,732
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.7

Open the chart page →

8,491
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.7

Open the chart page →

3,543
ghostgroundhog2k0.212.141 of 1See more

ghost groundhog2k 0.212.14

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
hono@4.12.18
4.13.7

Open the chart page →

2,467
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.7

Open the chart page →

3,221
observability-mcpobservability-mcpOfficialVerified publisher2.9.121 of 2See more

observability-mcp observability-mcp 2.9.12

1 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
hono@4.13.5
4.13.7

Open the chart page →

119
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.7

Open the chart page →

34,115
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.13.7

Open the chart page →

5,547
crowdsec-web-uizekker6Verified publisher0.53.01 of 1See more

crowdsec-web-ui zekker6 0.53.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.2714d62ccd80c
hono@4.12.27
4.13.7

Open the chart page →

1,417
adeptia-automate-mcpadeptia-automate-mcp1.0.02 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.7
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.7

Open the chart page →

4,038
outlineadnoctemVerified publisher0.1.21 of 1See more

outline adnoctem 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
outlinewiki/outline:1.10.1832051f039b4
hono@4.13.0
4.13.7

Open the chart page →

1,875
akeyless-gatewayakeyless-services-helmVerified publisher3.6.01 of 2See more

akeyless-gateway akeyless-services-helm 3.6.0

1 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
akeyless/gateway:5.4.0d4768a9b089c
hono@4.13.5
4.13.7

Open the chart page →

1,606
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
hono@4.12.18
4.13.7

Open the chart page →

1,440
mcp-for-argocdchristianhuthVerified publisher2.0.01 of 1See more

mcp-for-argocd christianhuth 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.7

Open the chart page →

2,209
fluxer-helmfluxer-helm0.3.01 of 18See more

fluxer-helm fluxer-helm 0.3.0

1 of the 18 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
hono@4.12.2
4.13.7

Open the chart page →

30,173
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
hono@4.12.18
4.13.7

Open the chart page →

2,978
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.13.7

Open the chart page →

3,072
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
hono@4.13.2
4.13.7

Open the chart page →

2,206
nocodbinseefrlab0.2.01 of 1See more

nocodb inseefrlab 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
nocodb/nocodb:latest4ccfc5114506
hono@4.13.1
4.13.7

Open the chart page →

743
api-key-managerjtektVerified publisher0.3.01 of 4See more

api-key-manager jtekt 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/api-key-manager-api:v0.1.175a48d987e0f
hono@4.12.21
4.13.7

Open the chart page →

6,708
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.7

Open the chart page →

1,519
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.13.7

Open the chart page →

2,490
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.13.7

Open the chart page →

1,887
mcp-kubernetesmcp-helmVerified publisher0.2.71 of 1See more

mcp-kubernetes mcp-helm 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
mcp/kubernetes:latest5ffbf7f0a8aa
hono@4.12.28
4.13.7

Open the chart page →

6,233
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.7

Open the chart page →

1,595
cloakbrowser-mcpobeoneVerified publisher0.3.31 of 1See more

cloakbrowser-mcp obeone 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
swimmwatch/cloakbrowser-mcp:1.14.1f6986203a121
hono@4.13.5
4.13.7

Open the chart page →

2,589
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.7

Open the chart page →

1,595
console-apiovrclk-20.1.11 of 1See more

console-api ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/akash-network/console-api:2.64.0ba359097329d
hono@4.6.12
4.13.7

Open the chart page →

3,954
provider-proxyovrclk-20.1.11 of 1See more

provider-proxy ovrclk-2 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/akash-network/provider-proxy:1.4.353f533d7c6f8
hono@4.6.12
4.13.7

Open the chart page →

2,864
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.7

Open the chart page →

6,932
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.13.7

Open the chart page →

5,192
its-mytabsstone0.3.01 of 1See more

its-mytabs stone 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.7

Open the chart page →

1,849
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-93981.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.13.7

Open the chart page →

2,408

Container images carrying it

46 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/ghost:6.65.090592b712b6b
hono@4.12.18
4.13.7
2
n8nio/n8n:2.36.714c4285bc303
hono@4.12.34
4.13.7
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
hono@4.12.5
4.13.7
1
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
hono@4.12.7
4.13.7
1
akeyless/gateway:5.4.0d4768a9b089c
hono@4.13.5
4.13.7
1
directus/directus:12.0.29c8470ea465c
hono@4.12.4
4.13.7
1
diygod/rsshub:2025-11-097a6312cac0d5
hono@4.10.4
4.13.7
1
docmost/docmost:0.96.0b56947fcfd08
hono@4.12.34
4.13.7
1
drumsergio/lynxprompt:2.0.75c6afb6679301
hono@4.12.18
4.13.7
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
hono@4.12.14
4.13.7
1
helmforge/strapi-base:5.52.270e9143d6d92
hono@4.13.2
4.13.7
1
library/ghost:6.64.0586821cfebac
hono@4.12.18
4.13.7
1
library/ghost:6.65.0-alpine3.23fea3264f902e
hono@4.12.18
4.13.7
1
louislam/its-mytabs:1.7.02e478d3170bd
hono@4.13.1
4.13.7
1
mcp/kubernetes:latest5ffbf7f0a8aa
hono@4.12.28
4.13.7
1
n8nio/n8n:2.25.7761374d4eb84
hono@4.12.18
4.13.7
1
n8nio/n8n:2.40.59f693fd55655
hono@4.12.34
4.13.7
1
n8nio/n8n:2.36.8cfe2704ff858
hono@4.12.34
4.13.7
1
n8nio/n8n:2.41.3fdce8f852ac7
hono@4.12.34
4.13.7
1
nocodb/nocodb:latest4ccfc5114506
hono@4.13.1
4.13.7
1
nocodb/nocodb:0.301.5d9516f0bf546
hono@4.12.8
4.13.7
1
outlinewiki/outline:1.10.1832051f039b4
hono@4.13.0
4.13.7
1
penpotapp/mcp:2.18.09270da9fab95
hono@4.13.5
4.13.7
1
rocketchat/account-service:8.6.144af8ac4e711
hono@4.12.25
4.13.7
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
hono@4.12.25
4.13.7
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
hono@4.12.25
4.13.7
1
rocketchat/presence-service:8.6.1c1170bdfe797
hono@4.12.25
4.13.7
1
swimmwatch/cloakbrowser-mcp:1.14.1f6986203a121
hono@4.13.5
4.13.7
1
treskon/portrait-ui:DEV-lateste7970783bc8d
hono@4.12.32
4.13.7
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
hono@4.12.3
4.13.7
1
ghcr.io/akash-network/console-api:2.64.0ba359097329d
hono@4.6.12
4.13.7
1
ghcr.io/akash-network/provider-proxy:1.4.353f533d7c6f8
hono@4.6.12
4.13.7
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
hono@4.12.14
4.13.7
1
ghcr.io/fluxerapp/fluxer-api:2026.820.164808f683541d5374
hono@4.12.2
4.13.7
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
hono@4.12.23
4.13.7
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
hono@4.7.11
4.13.7
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
hono@4.12.32
4.13.7
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
hono@4.12.18
4.13.7
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
hono@4.12.27
4.13.7
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
hono@4.12.30
4.13.7
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:main06adb21bfdfc
hono@4.12.18
4.13.7
1
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.2714d62ccd80c
hono@4.12.27
4.13.7
1
ghcr.io/thotischner/observability-mcp:3.9.11775e1e84d5d1
hono@4.13.5
4.13.7
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
hono@4.11.4
4.13.7
1
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
hono@4.6.12
4.13.7
1
public.ecr.aws/jtekt-corporation/api-key-manager-api:v0.1.175a48d987e0f
hono@4.12.21
4.13.7
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.