StackRadar

GHSA-253c-mchw-3w2r

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 17,957 indexed, latest versions
Container images
107
deployed by those charts
Fix available
1 of 1
affected package

markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

Carried by container images the latest versions of 119 of 17,957 indexed charts deploy, on 107 images.

Affected packageAffected versionsFixed inImages
markdown-itnpm8.4.0, 8.4.2, 10.0.0, 11.0.1+13 more14.3.1107
OSV records
GHSA-253c-mchw-3w2r

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.1

Open the chart page →

4,858
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.1

Open the chart page →

4,858
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
markdown-it@12.3.2
14.3.1

Open the chart page →

4,858
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
markdown-it@14.1.0
14.3.1

Open the chart page →

15,646
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
markdown-it@13.0.2
14.3.1

Open the chart page →

1,992
canary-checkerflanksourceVerified publisher1.2.01 of 2See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
flanksource/canary-checker-ui:v1.4.281764c84e550db
markdown-it@14.1.0
14.3.1

Open the chart page →

4,878
flanksource-uiflanksourceVerified publisher1.4.3201 of 1See more

flanksource-ui flanksource 1.4.320

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
flanksource/incident-manager-ui:v1.4.320d952c2a774a2
markdown-it@14.3.0
14.3.1

Open the chart page →

2,784
mission-controlflanksourceVerified publisher0.1.3381 of 8See more

mission-control flanksource 0.1.338

1 of the 8 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
markdown-it@14.3.0
14.3.1

Open the chart page →

9,535
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
markdown-it@12.3.2
14.3.1

Open the chart page →

35,858
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
markdown-it@14.0.0
14.3.1

Open the chart page →

9,268
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
markdown-it@8.4.2
14.3.1

Open the chart page →

22,464
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
markdown-it@8.4.2
14.3.1

Open the chart page →

24,643
hive-appgraphql-hive1.0.01 of 1See more

hive-app graphql-hive 1.0.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
markdown-it@12.3.2
14.3.1

Open the chart page →

2,825
hive-appgraphql-hive-subcharts1.0.01 of 1See more

hive-app graphql-hive-subcharts 1.0.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/kamilkisiela/graphql-hive/app:59b64c36c866b3555c135c70de76a884e63f8619a4a3639899f7
markdown-it@12.3.2
14.3.1

Open the chart page →

2,825
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
markdown-it@11.0.1
14.3.1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
markdown-it@11.0.1
14.3.1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
markdown-it@11.0.1
14.3.1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
markdown-it@11.0.1
14.3.1

Open the chart page →

91,279
countlyhelmforgeVerified publisher1.2.81 of 3See more

countly helmforge 1.2.8

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
markdown-it@14.1.0
14.3.1

Open the chart page →

77,505
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
markdown-it@14.3.0
14.3.1

Open the chart page →

2,760
strapihelmforgeVerified publisher2.3.151 of 3See more

strapi helmforge 2.3.15

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
helmforge/strapi-base:5.52.270e9143d6d92
markdown-it@14.3.0
14.3.1

Open the chart page →

2,004
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
markdown-it@11.0.1
14.3.1

Open the chart page →

4,490
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
markdown-it@12.2.0
14.3.1

Open the chart page →

5,125
keyoxide-webittrident-oss0.2.31 of 1See more

keyoxide-web ittrident-oss 0.2.3

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
keyoxide/keyoxide:stable96f27a71269d
markdown-it@8.4.2
14.3.1

Open the chart page →

2,442
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
markdown-it@14.1.1
14.3.1

Open the chart page →

3,887
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
markdown-it@8.4.0
14.3.1

Open the chart page →

6,656
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
markdown-it@14.1.1
14.3.1

Open the chart page →

3,534
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
markdown-it@14.1.1
14.3.1

Open the chart page →

3,111
efklovemew67Verified publisher0.0.11 of 2See more

efk lovemew67 0.0.1

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
nshou/elasticsearch-kibana:kibana7a1d1e36814d1
markdown-it@12.3.2
14.3.1

Open the chart page →

3,989
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
markdown-it@8.4.2
14.3.1

Open the chart page →

8,064
searchmcp-helmVerified publisher0.1.31 of 2See more

search mcp-helm 0.1.3

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
laituanmanh/websearch-crawler:latest63b6da557c71
markdown-it@14.1.0
14.3.1

Open the chart page →

9,895
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.1

Open the chart page →

12,278
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.1

Open the chart page →

12,278
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
markdown-it@10.0.0
14.3.1

Open the chart page →

12,700
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
markdown-it@12.3.2
14.3.1

Open the chart page →

2,736
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
markdown-it@10.0.0
14.3.1
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
markdown-it@10.0.0
14.3.1
mojaloop/role-assignment-service:v2.1.0def4bf273721
markdown-it@10.0.0
14.3.1

Open the chart page →

16,206
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
markdown-it@10.0.0
14.3.1

Open the chart page →

12,053
mojaloopmojaloop14.0.03 of 6See more

mojaloop mojaloop 14.0.0

3 of the 6 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
markdown-it@10.0.0
14.3.1
mojaloop/central-ledger:v13.14.01abc8a7aa71c
markdown-it@10.0.0
14.3.1
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
markdown-it@10.0.0
14.3.1

Open the chart page →

20,038
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
markdown-it@10.0.0
14.3.1

Open the chart page →

2,897
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
markdown-it@10.0.0
14.3.1

Open the chart page →

2,716
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
markdown-it@10.0.0
14.3.1

Open the chart page →

2,436
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
markdown-it@12.3.2
14.3.1

Open the chart page →

2,736
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
markdown-it@14.1.0
14.3.1

Open the chart page →

5,425
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
markdown-it@13.0.1
14.3.1

Open the chart page →

3,377
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
markdown-it@13.0.2
14.3.1

Open the chart page →

1,441
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
markdown-it@14.1.1
14.3.1

Open the chart page →

4,032
audacitynicholaswildeVerified publisher0.1.41 of 1See more

audacity nicholaswilde 0.1.4

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/audacity:version-3.0.2cdf203db1e50
markdown-it@12.1.0
14.3.1

Open the chart page →

24,016
digikamnicholaswildeVerified publisher1.0.01 of 1See more

digikam nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/digikam:version-7.3.055b4c7f320ae
markdown-it@12.2.0
14.3.1

Open the chart page →

25,199
doublecommandernicholaswildeVerified publisher1.0.21 of 1See more

doublecommander nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/doublecommander:version-0.8.2-1d92969a929c2
markdown-it@12.3.0
14.3.1

Open the chart page →

26,351
filezillanicholaswildeVerified publisher1.0.11 of 1See more

filezilla nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/filezilla:version-3.51.0-r15103cdd266ce
markdown-it@12.2.0
14.3.1

Open the chart page →

3,247
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
markdown-it@10.0.0
14.3.1

Open the chart page →

27,908
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
markdown-it@12.2.0
14.3.1

Open the chart page →

10,347
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry GHSA-253c-mchw-3w2r.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
markdown-it@13.0.2
14.3.1

Open the chart page →

1,441

Container images carrying it

107 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
markdown-it@14.1.0
14.3.1
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
markdown-it@14.2.0
14.3.1
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
markdown-it@14.3.0
14.3.1
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
markdown-it@12.2.0
14.3.1
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
markdown-it@13.0.2
14.3.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
markdown-it@14.1.1
14.3.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
markdown-it@12.2.0
14.3.1
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.