StackRadar

GHSA-27jp-wm6q-gp25

Medium

Advisory

Published 13 Feb 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
111
of 17,781 indexed, latest versions
Container images
111
deployed by those charts
Fix available
1 of 1
affected package

sqlparse: formatting list of tuples leads to denial of service

Carried by container images the latest versions of 111 of 17,781 indexed charts deploy, on 111 images.

Affected packageAffected versionsFixed inImages
sqlparsepypi0.1.16, 0.2.2, 0.2.4, 0.3.0+8 more0.5.4111
OSV records
GHSA-27jp-wm6q-gp25

Charts affected

111 by stars
ChartLatestAffected imagesRadar Score
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
sqlparse@0.5.3
0.5.4

Open the chart page →

10,605
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
sqlparse@0.5.3
0.5.4

Open the chart page →

4,499
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
sqlparse@0.4.4
0.5.4

Open the chart page →

10,209
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
sqlparse@0.5.1
0.5.4

Open the chart page →

1,713
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
sqlparse@0.3.1
0.5.4

Open the chart page →

8,694
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
sqlparse@0.2.4
0.5.4

Open the chart page →

30,687
pgadminstakaterVerified publisher0.1.141 of 1See more

pgadmin stakater 0.1.14

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
dpage/pgadmin4:4.5a5a656e1d5fd
sqlparse@0.2.4
0.5.4

Open the chart page →

2,060
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
ghcr.io/substra/substra-backend:1.0.121967f54ec86
sqlparse@0.5.3
0.5.4

Open the chart page →

4,731
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
sqlparse@0.5.3
0.5.4

Open the chart page →

4,768
vinyl-lib-chartvinyl-libVerified publisher0.1.01 of 1See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
kporwit/vinyl_lib_app:v0.1.1217de0302218
sqlparse@0.4.2
0.5.4

Open the chart page →

3,392
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry GHSA-27jp-wm6q-gp25.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
sqlparse@0.4.4
0.5.4

Open the chart page →

7,085

Container images carrying it

111 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
cloudve/cloudlaunch-server:latest4a3d7fae90bb
sqlparse@0.4.2
0.5.4
3
dpage/pgadmin4:6.12781369df9994
sqlparse@0.4.2
0.5.4
3
amancevice/superset:0.35.212a0a9e66550
sqlparse@0.3.0
0.5.4
2
larribas/mlflow:1.9.105ccb0b46bfb
sqlparse@0.3.1
0.5.4
2
taigaio/taiga-back:latest4beed8f62c9f
sqlparse@0.5.3
0.5.4
2
weblate/weblate:4.2.2-169c160d37a3c
sqlparse@0.3.1
0.5.4
2
alexeyr7/sf-test-app:latestdf0b41fdbd53
sqlparse@0.4.2
0.5.4
1
amancevice/superset:0.28.1c8c04bfe3d66
sqlparse@0.2.4
0.5.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
sqlparse@0.4.4
0.5.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
sqlparse@0.5.1
0.5.4
1
apache/airflow:2.8.1e5560ad0b86e
sqlparse@0.4.4
0.5.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
sqlparse@0.3.0
0.5.4
1
apache/superset:4.0.1ab9467fd712c
sqlparse@0.4.4
0.5.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
sqlparse@0.5.3
0.5.4
1
baserow/backend:1.31.1e0b3c8130b91
sqlparse@0.5.0
0.5.4
1
baserow/baserow:1.30.1df0c42eb67e8
sqlparse@0.5.0
0.5.4
1
buntha/mlflow:2.1.1154542cc3083
sqlparse@0.4.3
0.5.4
1
camerahub/camerahub:0.36.23a5af37dd6e1b
sqlparse@0.4.4
0.5.4
1
chorss/docker-pgadmin4:4.115c549cacb8ab
sqlparse@0.2.4
0.5.4
1
codecov/self-hosted-api:24.4.10475cb1c3136
sqlparse@0.4.4
0.5.4
1
codecov/self-hosted-worker:24.4.1837f546b479b
sqlparse@0.4.4
0.5.4
1
cr0hn/ja-shortener:v0.1.414482d0bc4a1
sqlparse@0.5.3
0.5.4
1
datamate/seafile-professional:11.0.202dd66b722464
sqlparse@0.5.3
0.5.4
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
sqlparse@0.4.4
0.5.4
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
sqlparse@0.5.1
0.5.4
1
ddosify/selfhosted_backend:3.2.93c11e3182652
sqlparse@0.5.0
0.5.4
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
sqlparse@0.4.4
0.5.4
1
ddosify/selfhosted_hammermanager:1.2.471b8768f49bc
sqlparse@0.4.4
0.5.4
1
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
sqlparse@0.5.0
0.5.4
1
dpage/pgadmin4:8.418cd5711fc9a
sqlparse@0.4.4
0.5.4
1
dpage/pgadmin4:7.537946e4f3e7b
sqlparse@0.4.4
0.5.4
1
dpage/pgadmin4:9.252cb72a9e3da
sqlparse@0.5.3
0.5.4
1
dpage/pgadmin4:8.13561c1f8f99f2
sqlparse@0.5.1
0.5.4
1
dpage/pgadmin4:4.5a5a656e1d5fd
sqlparse@0.2.4
0.5.4
1
dpage/pgadmin4:4.22b1f00b8163cf
sqlparse@0.2.4
0.5.4
1
evk02/mlflow:2.2.1ef6ff257ef35
sqlparse@0.4.3
0.5.4
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
sqlparse@0.2.4
0.5.4
1
flagsmith/flagsmith-api:v2.6.0fd58556339a4
sqlparse@0.4.1
0.5.4
1
galaxy/cloudman-server:lateste5c265fe9fcd
sqlparse@0.4.2
0.5.4
1
galaxy/galaxy-init:v18.010267bad550e6
sqlparse@0.1.16
0.5.4
1
gethue/hue:4.11.011b649636e68
sqlparse@0.4.2
0.5.4
1
gethue/hue:4.10.05702b2c37ff9
sqlparse@0.4.1
0.5.4
1
gethue/hue:latest7d5c1b9f8a79
sqlparse@0.5.0
0.5.4
1
gluufederation/opendj:4.3.0_011a1128b28b95
sqlparse@0.4.2
0.5.4
1
grafana/oncall:v1.16.5499851658393
sqlparse@0.5.3
0.5.4
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
sqlparse@0.3.1
0.5.4
1
ha33ona/python:test6affdfc644d0
sqlparse@0.4.2
0.5.4
1
healthchecks/healthchecks:v2.8.1e82bb0836e30
sqlparse@0.4.3
0.5.4
1
hhyo/archery:v1.9.11aa41843419e
sqlparse@0.4.3
0.5.4
1
improwised/erpnext-worker:v13.4.197280b55cbd4
sqlparse@0.4.1
0.5.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.