StackRadar

GHSA-3q6v-r5mr-hxv8

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
36
of 17,966 indexed, latest versions
Container images
37
deployed by those charts
Fix available
1 of 1
affected package

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Carried by container images the latest versions of 36 of 17,966 indexed charts deploy, on 37 images.

Affected packageAffected versionsFixed inImages
league/commonmarkcomposer2.2.1, 2.3.0, 2.3.3, 2.3.4+11 more2.10.237
OSV records
GHSA-3q6v-r5mr-hxv8

Charts affected

36 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
league/commonmark@2.3.4
2.10.2

Open the chart page →

88,954
monicamonicaOfficialVerified publisher1.0.151 of 1See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/monicahq/monica-next:main8be69156acbb
league/commonmark@2.7.1
2.10.2

Open the chart page →

6,192
bookstackgabe565Verified publisher0.20.01 of 1See more

bookstack gabe565 0.20.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/commonmark@2.6.1
2.10.2

Open the chart page →

3,057
invoiceninjainvoiceninjaVerified publisher0.10.21 of 5See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
invoiceninja/invoiceninja:5.6.241437916dee01
league/commonmark@2.4.0
2.10.2

Open the chart page →

2,767
bookstackbookstack-mgVerified publisher0.3.11 of 2See more

bookstack bookstack-mg 0.3.1

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
linuxserver/bookstack:26.05.202605282ebf97852661
league/commonmark@2.8.2
2.10.2

Open the chart page →

1,955
part-dbpart-dbVerified publisher0.1.21 of 1See more

part-db part-db 0.1.2

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
jbtronics/part-db1:latestfd68338829ed
league/commonmark@2.10.0
2.10.2

Open the chart page →

3,725
glpieftechcombr-glpiVerified publisher2.12.12 of 5See more

glpi eftechcombr-glpi 2.12.1

2 of the 5 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
eftechcombr/glpi:php-fpm-12.0.0-rc27573fa8503ee
league/commonmark@2.10.0
2.10.2
eftechcombr/glpi:nginx-12.0.0-rc2e5db0c32f930
league/commonmark@2.10.0
2.10.2

Open the chart page →

5,203
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/commonmark@2.8.0
2.10.2

Open the chart page →

4,516
firefly-iiigeek-cookbookVerified publisher0.3.01 of 1See more

firefly-iii geek-cookbook 0.3.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.6.142f4283bd0cf7
league/commonmark@2.2.1
2.10.2

Open the chart page →

2,372
monicageek-cookbookVerified publisher8.2.01 of 1See more

monica geek-cookbook 8.2.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
library/monica:3.7.0-apacheceb1ba4196ab
league/commonmark@2.2.1
2.10.2

Open the chart page →

2,577
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
leantime/leantime:3.3.3ad4bfb0699d3
league/commonmark@2.5.3
2.10.2

Open the chart page →

6,806
castopodh2mVerified publisher1.12.101 of 3See more

castopod h2m 1.12.10

1 of the 3 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
castopod/castopod:1.12.101fd37280cbb2
league/commonmark@2.5.3
2.10.2

Open the chart page →

10,849
glpikitsune-itopsVerified publisher1.0.71 of 3See more

glpi kitsune-itops 1.0.7

1 of the 3 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
glpi/glpi:latest7b50172cdb7d
league/commonmark@2.10.0
2.10.2

Open the chart page →

4,179
linkstackadnoctemVerified publisher0.4.01 of 1See more

linkstack adnoctem 0.4.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latest1c8b05399ee4
league/commonmark@2.8.0
2.10.2

Open the chart page →

2,255
cspconsolecspconsole1.3.111 of 5See more

cspconsole cspconsole 1.3.11

1 of the 5 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/commonmark@2.8.2
2.10.2

Open the chart page →

13,368
webtreesdjjudas21Verified publisher3.0.01 of 1See more

webtrees djjudas21 3.0.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/commonmark@2.8.2
2.10.2

Open the chart page →

6,654
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
league/commonmark@2.4.2
2.10.2

Open the chart page →

1,759
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/commonmark@2.3.0
2.10.2

Open the chart page →

21,697
firefly-iiifirefly-iii1.10.11 of 1See more

firefly-iii firefly-iii 1.10.1

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2

Open the chart page →

5,699
firefly-iii-stackfirefly-iii0.10.22 of 4See more

firefly-iii-stack firefly-iii 0.10.2

2 of the 4 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2

Open the chart page →

11,569
importerfirefly-iii1.6.01 of 1See more

importer firefly-iii 1.6.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2

Open the chart page →

5,478
linkstackfmjstudios0.2.21 of 1See more

linkstack fmjstudios 0.2.2

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
linkstackorg/linkstack:latestabd691b4293b
league/commonmark@2.4.0
2.10.2

Open the chart page →

2,752
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpineb2d4efc7c2b3
league/commonmark@2.4.2
2.10.2

Open the chart page →

624
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
league/commonmark@2.3.3
2.10.2

Open the chart page →

4,873
castopodhelmforgeVerified publisher1.2.91 of 3See more

castopod helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
league/commonmark@2.8.0
2.10.2

Open the chart page →

9,883
heimdallhelmforgeVerified publisher1.1.141 of 1See more

heimdall helmforge 1.1.14

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.8.34c2b77d7e391
league/commonmark@2.8.2
2.10.2

Open the chart page →

194
fireflyhomeenterpriseinc2.7.02 of 2See more

firefly homeenterpriseinc 2.7.0

2 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.7.12c0300cfd3d76
league/commonmark@2.3.5
2.10.2
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/commonmark@2.3.5
2.10.2

Open the chart page →

3,345
firefly-iiikubernetes-homelab-helm-chartsVerified publisher0.1.31 of 3See more

firefly-iii kubernetes-homelab-helm-charts 0.1.3

1 of the 3 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
fireflyiii/core:version-6.6.6ae69fdd95cde
league/commonmark@2.8.2
2.10.2

Open the chart page →

4,839
librenmslibrenms10.2.01 of 5See more

librenms librenms 10.2.0

1 of the 5 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
librenms/librenms:26.9.1.1814e3fb8d837
league/commonmark@2.10.0
2.10.2

Open the chart page →

2,622
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
league/commonmark@2.4.0
2.10.2

Open the chart page →

13,549
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
league/commonmark@2.5.3
2.10.2

Open the chart page →

2,355
firefly-iiiphntom0.2.101 of 2See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/commonmark@2.3.0
2.10.2

Open the chart page →

2,069
coolifyquench-coolifyVerified publisher0.0.291 of 4See more

coolify quench-coolify 0.0.29

1 of the 4 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/coolify-appdigest-pinned92ab37c5b6c4
league/commonmark@2.10.1
2.10.2

Open the chart page →

460
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
league/commonmark@2.7.1
2.10.2

Open the chart page →

68,410
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/commonmark@2.3.3
2.10.2

Open the chart page →

2,495
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry GHSA-3q6v-r5mr-hxv8.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/commonmark@2.8.1
2.10.2

Open the chart page →

1,138

Container images carrying it

37 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
fireflyiii/core:version-6.5.9fe4ecec4c2ba
league/commonmark@2.8.2
2.10.2
2
fireflyiii/data-importer:version-2.2.3ab52bf932546
league/commonmark@2.8.2
2.10.2
2
akaunting/akaunting:3.0.1552811b36ec3a
league/commonmark@2.4.0
2.10.2
1
akaunting/akaunting:3.1.21-fpm-alpine-nginxe7d5c245b1a0
league/commonmark@2.8.0
2.10.2
1
anonaddy/anonaddy:0.12.3957a95565166
league/commonmark@2.3.3
2.10.2
1
castopod/castopod:1.12.101fd37280cbb2
league/commonmark@2.5.3
2.10.2
1
castopod/castopod:1.15.54e4f0440520f
league/commonmark@2.8.0
2.10.2
1
cspconsole/csp-control-center:1.0.1046dda4a31bd6
league/commonmark@2.8.2
2.10.2
1
eftechcombr/glpi:php-fpm-12.0.0-rc27573fa8503ee
league/commonmark@2.10.0
2.10.2
1
eftechcombr/glpi:nginx-12.0.0-rc2e5db0c32f930
league/commonmark@2.10.0
2.10.2
1
fireflyiii/core:version-5.6.142f4283bd0cf7
league/commonmark@2.2.1
2.10.2
1
fireflyiii/core:version-6.6.6ae69fdd95cde
league/commonmark@2.8.2
2.10.2
1
fireflyiii/core:version-5.7.12c0300cfd3d76
league/commonmark@2.3.5
2.10.2
1
fireflyiii/data-importer:version-0.9.1665500ce0fe66
league/commonmark@2.3.5
2.10.2
1
glpi/glpi:latest7b50172cdb7d
league/commonmark@2.10.0
2.10.2
1
invoiceninja/invoiceninja:5.6.241437916dee01
league/commonmark@2.4.0
2.10.2
1
jbtronics/part-db1:latestfd68338829ed
league/commonmark@2.10.0
2.10.2
1
leantime/leantime:3.3.3ad4bfb0699d3
league/commonmark@2.5.3
2.10.2
1
library/monica:4.1.2-fpm-alpineb2d4efc7c2b3
league/commonmark@2.4.2
2.10.2
1
library/monica:3.7.0-apacheceb1ba4196ab
league/commonmark@2.2.1
2.10.2
1
librenms/librenms:24.11.00920bc9117a8
league/commonmark@2.5.3
2.10.2
1
librenms/librenms:26.9.1.1814e3fb8d837
league/commonmark@2.10.0
2.10.2
1
linkstackorg/linkstack:latest1c8b05399ee4
league/commonmark@2.8.0
2.10.2
1
linkstackorg/linkstack:latestabd691b4293b
league/commonmark@2.4.0
2.10.2
1
linuxserver/bookstack:26.05.202605282ebf97852661
league/commonmark@2.8.2
2.10.2
1
linuxserver/heimdall:2.8.34c2b77d7e391
league/commonmark@2.8.2
2.10.2
1
linuxserver/heimdall:2.6.371597f4461e4
league/commonmark@2.4.2
2.10.2
1
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
league/commonmark@2.3.0
2.10.2
1
snipe/snipe-it:v8.3.1141ebf2386fe
league/commonmark@2.7.1
2.10.2
1
snipe/snipe-it:v6.0.1455fb7636a98c
league/commonmark@2.3.4
2.10.2
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
league/commonmark@2.8.1
2.10.2
1
ghcr.io/linuxserver/bookstack:version-v24.12.1cc795b254b73
league/commonmark@2.6.1
2.10.2
1
ghcr.io/monicahq/monica-next:main8be69156acbb
league/commonmark@2.7.1
2.10.2
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
league/commonmark@2.8.2
2.10.2
1
ghcr.io/quenchworks/images/coolify-app92ab37c5b6c4
league/commonmark@2.10.1
2.10.2
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
league/commonmark@2.3.3
2.10.2
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
league/commonmark@2.3.0
2.10.2
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.