StackRadar

GHSA-5p4m-2wfm-xmqj

High

Advisory

Published 6 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
474
of 17,787 indexed, latest versions
Container images
470
deployed by those charts
Fix available
1 of 1
affected package

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Carried by container images the latest versions of 474 of 17,787 indexed charts deploy, on 470 images.

Affected packageAffected versionsFixed inImages
js-yamlnpm3.5.5, 3.6.1, 3.7.0, 3.9.1+13 more3.15.1, 4.3.1470
OSV records
GHSA-5p4m-2wfm-xmqj

Charts affected

474 by stars
ChartLatestAffected imagesRadar Score
uoappuoapp1.1.01 of 1See more

uoapp uoapp 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
okaforuchena/uo-docker:V1.0.0004e81250f48
js-yaml@4.1.0
4.3.1

Open the chart page →

1,187
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
js-yaml@4.1.1
4.3.1

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
js-yaml@3.14.1
3.15.1

Open the chart page →

4,768
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
js-yaml@3.14.1
3.15.1

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
js-yaml@4.1.0
4.3.1

Open the chart page →

1,341
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
js-yaml@4.1.1
4.3.1

Open the chart page →

4,305
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
js-yaml@4.1.1
4.3.1

Open the chart page →

2,076
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
js-yaml@4.1.0
4.3.1

Open the chart page →

3,118
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
js-yaml@4.1.0
4.3.1

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
js-yaml@4.1.0
4.3.1

Open the chart page →

5,984
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
js-yaml@3.14.1
3.15.1

Open the chart page →

5,484
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
js-yaml@4.0.0
4.3.1

Open the chart page →

2,559
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1

Open the chart page →

14,364
webhookie-allwebhookie0.1.22 of 3See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1
library/mongo:4.44be76f674fc4
js-yaml@3.13.1
3.15.1

Open the chart page →

28,605
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
js-yaml@3.7.0
3.15.1

Open the chart page →

10,127
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
js-yaml@4.3.0
4.3.1

Open the chart page →

280
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
js-yaml@3.14.0
3.15.1

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
js-yaml@3.14.0
3.15.1

Open the chart page →

5,459
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
js-yaml@4.1.0
4.3.1

Open the chart page →

6,285
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
js-yaml@3.14.0
3.15.1

Open the chart page →

5,806
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
js-yaml@4.1.0
4.3.1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
js-yaml@4.1.0
4.3.1

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
js-yaml@4.1.0
4.3.1

Open the chart page →

1,752
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/mongo:latest5211c51171f5
js-yaml@3.13.1
3.15.1

Open the chart page →

13,677
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
js-yaml@3.14.1
3.15.1

Open the chart page →

9,381

Container images carrying it

470 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
rocketchat/account-service:8.6.144af8ac4e711
js-yaml@3.14.1
3.15.1
1
rocketchat/authorization-service:8.6.16bc18fb5d0e5
js-yaml@3.14.1
3.15.1
1
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
js-yaml@3.14.1
3.15.1
1
rocketchat/presence-service:8.6.1c1170bdfe797
js-yaml@3.14.1
3.15.1
1
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
js-yaml@4.1.0
4.3.1
1
samajh/alprbackend:latestea742b4372ad
js-yaml@3.14.0
3.15.1
1
samajh/alprfrontend:latest05ef4fddbb75
js-yaml@3.14.1
3.15.1
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
js-yaml@4.1.0
4.3.1
1
sharanalwar/redchef-frontend:latest5e82950b16b7
js-yaml@4.1.0
4.3.1
1
sigp/siren:v3.0.42c219b04758e
js-yaml@4.1.0
4.3.1
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
js-yaml@3.14.1
3.15.1
1
skylenet/ethstats-server:pow-latestd757cc016198
js-yaml@3.14.1
3.15.1
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
js-yaml@3.7.0
3.15.1
1
solidproject/community-server:6.0.2ccc4acb7e9a1
js-yaml@4.1.0
4.3.1
1
soulou2019/node-server:latest5e6ecfcc109e
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.26.3092384dba45d
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
js-yaml@4.1.0
4.3.1
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
js-yaml@4.1.0
4.3.1
1
srini78/nodejswebappeks:latest5d1cbdc6833a
js-yaml@4.1.0
4.3.1
1
stanfordoval/almond-server:latest1a63cdccedaf
js-yaml@3.14.1
3.15.1
1
subsquid/hydra-indexer:5.0.0-alpha.37a7f8b9bad7ee
js-yaml@4.1.0
4.3.1
1
subsquid/substrate-explorer:firesquid0889a857f192
js-yaml@4.1.0
4.3.1
1
supabase/storage-api:v1.60.4c8eb9858eafe
js-yaml@4.1.1
4.3.1
1
supabase/storage-api:latestf6c42a04163d
js-yaml@4.3.0
4.3.1
1
sysnet4admin/colosseum-cms:loge74b43c7f492
js-yaml@4.1.0
4.3.1
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
js-yaml@4.1.0
4.3.1
1
temporalio/web:1.14.033cfa863d8ce
js-yaml@3.14.0
3.15.1
1
tenureai/tenure:v1.0.285f5b222df9a5
js-yaml@3.14.2
3.15.1
1
testhubio/testhub-frontend:on-preme86c2db53be8
js-yaml@3.13.1
3.15.1
1
th0th/node-red:4.0.3-debiand06fa39f7406
js-yaml@4.1.0
4.3.1
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
js-yaml@4.1.0
4.3.1
1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
js-yaml@4.1.0
4.3.1
1
thingsboard/tb-js-executor:3.4.113e1eadf8ace
js-yaml@4.1.0
4.3.1
1
thingsboard/tb-web-ui:3.4.157f98ed53b3d
js-yaml@4.1.0
4.3.1
1
thingsboard/tb-web-ui:3.6.0d388378062cc
js-yaml@4.1.0
4.3.1
1
thmmniii/fbs-qcm-frontend:v1.27.1a347f7f4d144
js-yaml@4.1.0
4.3.1
1
tobirachel/node-project3:v17d9f37154994
js-yaml@4.1.0
4.3.1
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
js-yaml@4.1.0
4.3.1
1
treskon/portrait-ui:DEV-lateste7970783bc8d
js-yaml@4.1.0
4.3.1
1
tundeficky/nodejs-app:v1.0.03cf9a9ce54e8
js-yaml@4.1.0
4.3.1
1
twentycrm/twenty:v2.22.0e7d9948bf284
js-yaml@4.2.0
4.3.1
1
ubercadence/web:v3.29.58564a5b44a6d
js-yaml@3.7.0
3.15.1
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
js-yaml@3.14.1
3.15.1
1
unleashorg/unleash-enterprise:7.5.0245aeba40053
js-yaml@4.1.1
4.3.1
1
unleashorg/unleash-proxy:v1.4.82538f89e2685
js-yaml@4.1.0
4.3.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.