StackRadar

GHSA-5p4m-2wfm-xmqj

High

Advisory

Published 6 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
475
of 17,781 indexed, latest versions
Container images
471
deployed by those charts
Fix available
1 of 1
affected package

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Carried by container images the latest versions of 475 of 17,781 indexed charts deploy, on 471 images.

Affected packageAffected versionsFixed inImages
js-yamlnpm3.5.5, 3.6.1, 3.7.0, 3.9.1+13 more3.15.1, 4.3.1471
OSV records
GHSA-5p4m-2wfm-xmqj

Charts affected

475 by stars
ChartLatestAffected imagesRadar Score
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
js-yaml@4.1.0
4.3.1

Open the chart page →

5,228
uoappuoapp1.1.01 of 1See more

uoapp uoapp 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
okaforuchena/uo-docker:V1.0.0004e81250f48
js-yaml@4.1.0
4.3.1

Open the chart page →

1,187
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
js-yaml@4.1.1
4.3.1

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
js-yaml@3.14.1
3.15.1

Open the chart page →

4,768
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
js-yaml@3.14.1
3.15.1

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
js-yaml@4.1.0
4.3.1

Open the chart page →

1,341
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
js-yaml@4.1.1
4.3.1

Open the chart page →

4,305
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
js-yaml@4.1.1
4.3.1

Open the chart page →

2,076
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
js-yaml@4.1.0
4.3.1

Open the chart page →

3,118
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
js-yaml@4.1.0
4.3.1

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
js-yaml@4.1.0
4.3.1

Open the chart page →

5,984
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
js-yaml@3.14.1
3.15.1

Open the chart page →

5,484
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
js-yaml@4.0.0
4.3.1

Open the chart page →

2,559
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1

Open the chart page →

14,364
webhookie-allwebhookie0.1.22 of 3See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1
library/mongo:4.44be76f674fc4
js-yaml@3.13.1
3.15.1

Open the chart page →

28,605
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
js-yaml@3.7.0
3.15.1

Open the chart page →

10,127
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
js-yaml@4.3.0
4.3.1

Open the chart page →

280
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
js-yaml@3.14.0
3.15.1

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
js-yaml@3.14.0
3.15.1

Open the chart page →

5,459
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
js-yaml@4.1.0
4.3.1

Open the chart page →

6,285
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
js-yaml@3.14.0
3.15.1

Open the chart page →

5,806
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
js-yaml@4.1.0
4.3.1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
js-yaml@4.1.0
4.3.1

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
js-yaml@4.1.0
4.3.1

Open the chart page →

1,752
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/mongo:latest5211c51171f5
js-yaml@3.13.1
3.15.1

Open the chart page →

13,677
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
js-yaml@3.14.1
3.15.1

Open the chart page →

9,381

Container images carrying it

471 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
siscc/dotstatsuite-sdmx-faceted-search:master12c5048f7402
js-yaml@3.14.2
3.15.1
2
stakater/stakater-nordmart-review-ui:1.0.143f4926eedc74
js-yaml@3.14.1
3.15.1
2
statsd/statsd:v0.8.6dab129e74c25
js-yaml@3.13.1
3.15.1
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
js-yaml@3.14.0
3.15.1
2
ghcr.io/lissy93/dashy:2.1.1acb40032ad4b
js-yaml@3.14.1
3.15.1
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
js-yaml@4.3.0
4.3.1
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
js-yaml@4.1.0
4.3.1
2
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
js-yaml@4.1.1
4.3.1
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
js-yaml@4.1.0
4.3.1
1
alazidis/stornx:1.1.1602d4f7f090c
js-yaml@4.1.0
4.3.1
1
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
js-yaml@3.13.1
3.15.1
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
js-yaml@3.13.1
3.15.1
1
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
js-yaml@3.14.1
3.15.1
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
js-yaml@4.1.0
4.3.1
1
apecloud/aperag-frontend:v0.0.0-nightlyb3ae37840ace
js-yaml@4.1.1
4.3.1
1
arfath29/3-tier-app-frontend:latest384b3e377f47
js-yaml@3.14.1
3.15.1
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
js-yaml@3.14.0
3.15.1
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
js-yaml@3.14.0
3.15.1
1
assistiot/fl_orchestrator:api-latest7473d77448e1
js-yaml@3.14.1
3.15.1
1
assistiot/open_api_frontend:1.0.1f11d82defc70
js-yaml@4.1.0
4.3.1
1
assistiot/smart-orchestrator_cluster:latest4f41e1defe99
js-yaml@4.1.0
4.3.1
1
assistiot/smart-orchestrator_enabler:latest89f37e88c871
js-yaml@4.1.0
4.3.1
1
assistiot/smart-orchestrator_repository:latesta8b8dbed04a4
js-yaml@4.1.0
4.3.1
1
automatischio/automatisch:0.15.03bace7a12d5f
js-yaml@4.1.0
4.3.1
1
baserow/baserow:1.30.1df0c42eb67e8
js-yaml@3.14.1
3.15.1
1
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
js-yaml@3.14.1
3.15.1
1
belirta/beli-docker:v1.0.0f65ad0e23b4d
js-yaml@4.1.0
4.3.1
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
js-yaml@3.14.1
3.15.1
1
bluerange/bluerange-mosquitto:25f1bfbba84832
js-yaml@3.14.1
3.15.1
1
bnjbvr/kresus:0.22.137e216b182c8
js-yaml@4.1.0
4.3.1
1
bnwokoye/nodejswebapp:latest74de7dc7ebfb
js-yaml@4.1.0
4.3.1
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
js-yaml@3.13.1
3.15.1
1
budibase/apps:3.41.344fe6feab985
js-yaml@4.3.0
4.3.1
1
budibase/worker:3.41.3de5e2e560ce8
js-yaml@4.2.0
4.3.1
1
carbonetes/carbonetes-analyzer:1.0.31b9b93c9a37f
js-yaml@3.14.1
3.15.1
1
catalysm/csmm:latestf003b35f54d9
js-yaml@3.14.1
3.15.1
1
ccjacobs14/amazon:59a9b14a6f09e
js-yaml@3.14.1
3.15.1
1
chainsafe/lodestar:v1.27.07b9fe4aa8073
js-yaml@4.1.0
4.3.1
1
chatwoot/chatwoot:v4.15.167ebc751c171
js-yaml@3.14.1
3.15.1
1
chibisafe/chibisafe:latest836467a50792
js-yaml@4.1.0
4.3.1
1
chibisafe/chibisafe-server:latest3da4fcbc1a18
js-yaml@4.1.0
4.3.1
1
chocobozzz/peertube:v8.1.5052712130691
js-yaml@4.1.1
4.3.1
1
coderaiser/cloudcmd:16.6.1b34a9775c7ce
js-yaml@4.1.0
4.3.1
1
codercom/code-server:4.11.0-debian1e2cc688008e
js-yaml@4.1.0
4.3.1
1
codercom/code-server:3.10.247605610ad8d
js-yaml@4.1.0
4.3.1
1
codetogether/codetogether:latest4348c8a38752
js-yaml@4.1.0
4.3.1
1
coldatom/containers-security-api:latesteae9e82da080
js-yaml@4.1.0
4.3.1
1
coldatom/containers-security-front:latest7c2fbbb41bcf
js-yaml@4.1.0
4.3.1
1
conduction/conduction-ui-app:devd591f5e6f2a9
js-yaml@3.14.1
3.15.1
1
contane/foreman:0.5.2efb98bdcc4e9
js-yaml@4.1.0
4.3.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.