StackRadar

GHSA-4gg8-gxpx-9rph

Medium

Advisory

Published 29 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
29
deployed by those charts
Fix available
2 of 2
affected packages

uv is vulnerable to arbitrary file write through entry point names

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 29 images.

Affected packageAffected versionsFixed inImages
uvpypi0.4.1, 0.4.29, 0.5.27, 0.6.1+15 more0.11.1525
uvcargo0.8.11, 0.10.11, 0.11.5, 0.11.6+3 more0.11.158
OSV records
GHSA-4gg8-gxpx-9rph

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.15

Open the chart page →

19,391
difydify-helmVerified publisher0.38.03 of 11See more

dify dify-helm 0.38.0

3 of the 11 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
uv@0.8.9
0.11.15
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
uv@0.8.9
0.11.15
langgenius/dify-api:1.16.1dcefa5f7c47c
uv@0.8.9
0.11.15

Open the chart page →

22,002
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.15

Open the chart page →

16,251
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.15

Open the chart page →

4,634
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
uv@0.11.6
0.11.15

Open the chart page →

5,880
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
uv@0.8.11
0.11.15

Open the chart page →

4,292
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.15

Open the chart page →

7,201
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
uv@0.11.14
uv@0.11.14
0.11.15
0.11.15

Open the chart page →

8,158
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.15
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.15

Open the chart page →

16,449
esphomealekcVerified publisher2.8.11 of 1See more

esphome alekc 2.8.1

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
esphome/esphome:2026.8.285abea33854b
uv@0.10.1
0.11.15

Open the chart page →

3,112
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.15

Open the chart page →

26,996
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.15

Open the chart page →

15,371
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.15

Open the chart page →

20,900
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
uv@0.11.5
0.11.15

Open the chart page →

2,481
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
uv@0.7.20
0.11.15

Open the chart page →

58,897
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
uv@0.10.1
0.11.15

Open the chart page →

3,121
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest000c5ee5ee96
uv@0.10.1
0.11.15

Open the chart page →

3,112
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.15

Open the chart page →

4,647
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
uv@0.10.11
uv@0.10.11
0.11.15
0.11.15

Open the chart page →

10,849
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.15

Open the chart page →

5,040
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
uv@0.11.11
0.11.15
0.11.15

Open the chart page →

7,081
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.15

Open the chart page →

5,823
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
uv@0.11.13
uv@0.11.13
0.11.15
0.11.15

Open the chart page →

1,672
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.15

Open the chart page →

4,749
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.15

Open the chart page →

21,211
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry GHSA-4gg8-gxpx-9rph.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
uv@0.10.11
0.11.15

Open the chart page →

1,419

Container images carrying it

29 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.15
1
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.15
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
uv@0.10.11
uv@0.10.11
0.11.15
0.11.15
1
esphome/esphome:2026.7.44866347cb5b4
uv@0.10.1
0.11.15
1
esphome/esphome:2026.8.285abea33854b
uv@0.10.1
0.11.15
1
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.15
1
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
uv@0.8.9
0.11.15
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
uv@0.8.9
0.11.15
1
langgenius/dify-api:1.16.1dcefa5f7c47c
uv@0.8.9
0.11.15
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.15
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
uv@0.11.13
uv@0.11.13
0.11.15
0.11.15
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
uv@0.11.6
0.11.15
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
uv@0.7.20
0.11.15
1
prowlercloud/prowler-api:5.31.14f252d579be2
uv@0.11.14
uv@0.11.14
0.11.15
0.11.15
1
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.15
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.15
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
uv@0.8.11
0.11.15
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.15
1
ghcr.io/esphome/esphome:latest000c5ee5ee96
uv@0.10.1
0.11.15
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.15
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.15
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.15
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
uv@0.11.5
0.11.15
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.15
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.15
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.15
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.15
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
uv@0.11.11
0.11.15
0.11.15
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
uv@0.10.11
0.11.15
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.