StackRadar

GHSA-5p4m-2wfm-xmqj

High

Advisory

Published 6 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
478
of 17,787 indexed, latest versions
Container images
474
deployed by those charts
Fix available
1 of 1
affected package

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Carried by container images the latest versions of 478 of 17,787 indexed charts deploy, on 474 images.

Affected packageAffected versionsFixed inImages
js-yamlnpm3.5.5, 3.6.1, 3.7.0, 3.9.1+13 more3.15.1, 4.3.1474
OSV records
GHSA-5p4m-2wfm-xmqj

Charts affected

478 by stars
ChartLatestAffected imagesRadar Score
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
js-yaml@4.1.1
4.3.1

Open the chart page →

2,029
unleash-proxyunleash0.8.121 of 1See more

unleash-proxy unleash 0.8.12

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
unleashorg/unleash-proxy:v1.4.82538f89e2685
js-yaml@4.1.0
4.3.1

Open the chart page →

929
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
js-yaml@4.1.0
4.3.1

Open the chart page →

5,234
uoappuoapp1.1.01 of 1See more

uoapp uoapp 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
okaforuchena/uo-docker:V1.0.0004e81250f48
js-yaml@4.1.0
4.3.1

Open the chart page →

1,187
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
js-yaml@4.1.1
4.3.1

Open the chart page →

3,747
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
js-yaml@3.14.1
3.15.1

Open the chart page →

4,769
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
js-yaml@3.14.1
3.15.1

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
js-yaml@4.1.0
4.3.1

Open the chart page →

1,341
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
js-yaml@4.1.1
4.3.1

Open the chart page →

4,360
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
js-yaml@4.1.1
4.3.1

Open the chart page →

2,077
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
js-yaml@3.14.1
3.15.1

Open the chart page →

6,470
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
js-yaml@4.1.0
4.3.1

Open the chart page →

3,119
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
js-yaml@4.1.0
4.3.1

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
js-yaml@4.1.0
4.3.1

Open the chart page →

5,774
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
js-yaml@3.14.1
3.15.1

Open the chart page →

5,484
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
js-yaml@4.0.0
4.3.1

Open the chart page →

2,559
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1

Open the chart page →

14,420
webhookie-allwebhookie0.1.22 of 3See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1
library/mongo:4.44be76f674fc4
js-yaml@3.13.1
3.15.1

Open the chart page →

28,699
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
js-yaml@3.7.0
3.15.1

Open the chart page →

10,127
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
js-yaml@4.3.0
4.3.1

Open the chart page →

280
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
js-yaml@3.14.0
3.15.1

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
js-yaml@3.14.0
3.15.1

Open the chart page →

5,472
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
js-yaml@4.1.0
4.3.1

Open the chart page →

6,323
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
js-yaml@3.14.0
3.15.1

Open the chart page →

5,807
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
js-yaml@4.1.0
4.3.1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
js-yaml@4.1.0
4.3.1

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
js-yaml@4.1.0
4.3.1

Open the chart page →

1,752
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/mongo:latest5211c51171f5
js-yaml@3.13.1
3.15.1

Open the chart page →

13,197
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
js-yaml@3.14.1
3.15.1

Open the chart page →

9,381

Container images carrying it

474 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
js-yaml@3.14.1
3.15.1
1
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
js-yaml@4.1.0
4.3.1
1
ghcr.io/zazuko/trifid:v6.0.159bda2bf65d4
js-yaml@4.2.0
4.3.1
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
js-yaml@4.1.0
4.3.1
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
js-yaml@3.14.1
3.15.1
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
js-yaml@3.14.1
3.15.1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
js-yaml@3.14.1
3.15.1
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
js-yaml@4.1.0
4.3.1
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
js-yaml@4.1.0
4.3.1
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
js-yaml@4.1.0
4.3.1
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
js-yaml@4.1.1
4.3.1
1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
js-yaml@3.9.1
3.15.1
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
js-yaml@3.13.1
3.15.1
1
quay.io/mittwald/kube-mail:latest04f1099241fc
js-yaml@4.1.0
4.3.1
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
js-yaml@3.14.0
3.15.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
js-yaml@4.3.0
4.3.1
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
js-yaml@4.1.1
4.3.1
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
js-yaml@4.1.0
4.3.1
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
js-yaml@3.14.1
3.15.1
1
quay.io/wekan/wekan:v5.65cb17600883a3
js-yaml@3.14.1
3.15.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
js-yaml@3.14.2
3.15.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
js-yaml@4.1.0
4.3.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
js-yaml@4.1.1
4.3.1
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
js-yaml@4.1.0
4.3.1
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.