StackRadar

GHSA-5p4m-2wfm-xmqj

High

Advisory

Published 6 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
478
of 17,787 indexed, latest versions
Container images
474
deployed by those charts
Fix available
1 of 1
affected package

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Carried by container images the latest versions of 478 of 17,787 indexed charts deploy, on 474 images.

Affected packageAffected versionsFixed inImages
js-yamlnpm3.5.5, 3.6.1, 3.7.0, 3.9.1+13 more3.15.1, 4.3.1474
OSV records
GHSA-5p4m-2wfm-xmqj

Charts affected

478 by stars
ChartLatestAffected imagesRadar Score
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
js-yaml@4.1.1
4.3.1

Open the chart page →

2,029
unleash-proxyunleash0.8.121 of 1See more

unleash-proxy unleash 0.8.12

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
unleashorg/unleash-proxy:v1.4.82538f89e2685
js-yaml@4.1.0
4.3.1

Open the chart page →

929
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
js-yaml@4.1.0
4.3.1

Open the chart page →

5,234
uoappuoapp1.1.01 of 1See more

uoapp uoapp 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
okaforuchena/uo-docker:V1.0.0004e81250f48
js-yaml@4.1.0
4.3.1

Open the chart page →

1,187
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
js-yaml@4.1.1
4.3.1

Open the chart page →

3,747
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
js-yaml@3.14.1
3.15.1

Open the chart page →

4,769
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
js-yaml@3.14.1
3.15.1

Open the chart page →

3,129
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
js-yaml@4.1.0
4.3.1

Open the chart page →

1,341
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
js-yaml@4.1.1
4.3.1

Open the chart page →

4,360
colanodevictorlane0.3.31 of 3See more

colanode victorlane 0.3.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/colanode/server:latest7006cac874fd
js-yaml@4.1.1
4.3.1

Open the chart page →

2,077
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
js-yaml@3.14.1
3.15.1

Open the chart page →

6,470
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
js-yaml@4.1.0
4.3.1

Open the chart page →

3,119
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
js-yaml@4.1.0
4.3.1

Open the chart page →

3,474
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
js-yaml@4.1.0
4.3.1

Open the chart page →

5,774
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
js-yaml@3.14.1
3.15.1

Open the chart page →

5,484
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
js-yaml@4.0.0
4.3.1

Open the chart page →

2,559
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1

Open the chart page →

14,420
webhookie-allwebhookie0.1.22 of 3See more

webhookie-all webhookie 0.1.2

2 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
js-yaml@4.1.0
4.3.1
library/mongo:4.44be76f674fc4
js-yaml@3.13.1
3.15.1

Open the chart page →

28,699
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
js-yaml@3.7.0
3.15.1

Open the chart page →

10,127
opensearch-dashboardswenerme3.8.01 of 1See more

opensearch-dashboards wenerme 3.8.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.8.0ca28e40a095f
js-yaml@4.3.0
4.3.1

Open the chart page →

280
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
js-yaml@3.14.0
3.15.1

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
js-yaml@3.14.0
3.15.1

Open the chart page →

5,472
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
js-yaml@4.1.0
4.3.1

Open the chart page →

6,323
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
js-yaml@3.14.0
3.15.1

Open the chart page →

5,807
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
js-yaml@4.1.0
4.3.1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
js-yaml@4.1.0
4.3.1

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
js-yaml@4.1.0
4.3.1

Open the chart page →

1,752
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
library/mongo:latest5211c51171f5
js-yaml@3.13.1
3.15.1

Open the chart page →

13,197
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-5p4m-2wfm-xmqj.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
js-yaml@3.14.1
3.15.1

Open the chart page →

9,381

Container images carrying it

474 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/data-fair/data-fair:3cc9498b64b5b
js-yaml@3.14.1
3.15.1
1
ghcr.io/data-fair/metrics:0a8d40779eeae
js-yaml@3.14.1
3.15.1
1
ghcr.io/data-fair/notify:3c739b74dabb0
js-yaml@3.14.1
3.15.1
1
ghcr.io/data-fair/portals:18b621866ceb2
js-yaml@3.15.0
3.15.1
1
ghcr.io/data-fair/processings:15a9216989707
js-yaml@3.14.1
3.15.1
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
js-yaml@3.14.1
3.15.1
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
js-yaml@3.13.1
3.15.1
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
js-yaml@4.1.0
4.3.1
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
js-yaml@4.1.0
4.3.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
js-yaml@4.1.0
4.3.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
js-yaml@4.1.0
4.3.1
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
js-yaml@4.1.1
4.3.1
1
ghcr.io/hiteshnayak305/cors-proxy:1.2.0e6ff0a131556
js-yaml@4.1.0
4.3.1
1
ghcr.io/immich-app/immich-server:v3.2.12ab6a6273755
js-yaml@4.3.0
4.3.1
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
js-yaml@4.3.0
4.3.1
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
js-yaml@4.1.0
4.3.1
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
js-yaml@4.1.0
4.3.1
1
ghcr.io/k8s-at-home/haste-server:latest827aa2f2389d
js-yaml@3.14.0
3.15.1
1
ghcr.io/leoquote/mergeable:latest451706815103
js-yaml@3.14.0
3.15.1
1
ghcr.io/leprechaun/lgtv2mqtt:latestac2e11c41ffb
js-yaml@4.1.0
4.3.1
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
js-yaml@3.14.1
3.15.1
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
js-yaml@3.13.1
3.15.1
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
js-yaml@4.2.0
4.3.1
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
js-yaml@4.2.0
4.3.1
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
js-yaml@4.1.0
4.3.1
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
js-yaml@4.1.0
4.3.1
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
js-yaml@4.1.0
4.3.1
1
ghcr.io/mario-f/kubevis:v1.4.0763daf9caf8e
js-yaml@3.14.1
3.15.1
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
js-yaml@3.14.1
3.15.1
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
js-yaml@3.14.1
3.15.1
1
ghcr.io/middleware-labs/odigos-ui:middleware-test-0.0.787120a4561a9
js-yaml@4.1.0
4.3.1
1
ghcr.io/middleware-labs/vision-ui:middleware-test-0.0.853772b7b42c7
js-yaml@4.1.0
4.3.1
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
js-yaml@4.1.0
4.3.1
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
js-yaml@4.1.0
4.3.1
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
js-yaml@3.14.1
3.15.1
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
js-yaml@4.1.0
4.3.1
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
js-yaml@3.14.1
3.15.1
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
js-yaml@4.1.0
4.3.1
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
js-yaml@4.1.1
4.3.1
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
js-yaml@4.0.0
4.3.1
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
js-yaml@4.1.0
4.3.1
1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
js-yaml@3.14.1
3.15.1
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
js-yaml@3.14.2
3.15.1
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
js-yaml@4.3.0
4.3.1
1
ghcr.io/tale/headplane:0.5.50dbc52cffc19
js-yaml@4.1.0
4.3.1
1
ghcr.io/vincenttaglia/indexer-tools:v3.4.45bae30456ddb
js-yaml@4.1.0
4.3.1
1
ghcr.io/waldo-vision/migrate:v0.3.6ae31923312ed
js-yaml@4.1.0
4.3.1
1
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
js-yaml@4.0.0
4.3.1
1
ghcr.io/wei-shaw/claude-relay-service:v1.1.292398c34934453
js-yaml@4.1.0
4.3.1
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
js-yaml@4.1.0
4.3.1
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.