StackRadar

GHSA-78g4-xqwv-q3g8

High

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
158
of 18,232 indexed, latest versions
Container images
136
deployed by those charts
Fix available
1 of 1
affected package

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Carried by container images the latest versions of 158 of 18,232 indexed charts deploy, on 136 images.

Affected packageAffected versionsFixed inImages
pillowpypi11.1.0, 11.2.1, 11.3.0, 12.0.0+4 more13.0.0136
OSV records
GHSA-78g4-xqwv-q3g8

Charts affected

158 by stars
ChartLatestAffected imagesRadar Score
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

765
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
pillow@12.3.0
13.0.0

Open the chart page →

6,754
netboxhelmforgeVerified publisher2.0.51 of 4See more

netbox helmforge 2.0.5

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
pillow@12.3.0
13.0.0

Open the chart page →

5,513
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

8,299
supersethelmforgeVerified publisher1.4.21 of 5See more

superset helmforge 1.4.2

1 of the 5 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
pillow@11.3.0
13.0.0

Open the chart page →

34,576
webodmhelmforgeVerified publisher1.1.21 of 4See more

webodm helmforge 1.1.2

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0

Open the chart page →

13,358
openaevhelm-openbasVerified publisher2.0.161 of 7See more

openaev helm-openbas 2.0.16

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
pillow@11.1.0
13.0.0

Open the chart page →

79,083
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
pillow@11.1.0
13.0.0

Open the chart page →

83,954
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
pillow@12.3.0
13.0.0

Open the chart page →

38,515
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
pillow@12.0.0
13.0.0

Open the chart page →

3,612
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
pillow@11.1.0
13.0.0

Open the chart page →

5,936
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestafcc516a2277
pillow@12.3.0
13.0.0

Open the chart page →

851
pgadmininseefrlab3.2.01 of 1See more

pgadmin inseefrlab 3.2.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

576
inventreeinventreeOfficialVerified publisher0.4.341 of 2See more

inventree inventree 0.4.34

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
inventree/inventree:1.6.17c1e251a6c52
pillow@11.1.0
13.0.0

Open the chart page →

6,185
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
pillow@12.2.0
13.0.0

Open the chart page →

50,201
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
pillow@12.2.0
13.0.0

Open the chart page →

2,531
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
pillow@11.2.1
13.0.0

Open the chart page →

3,798
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
pillow@11.3.0
13.0.0

Open the chart page →

11,853
librephotosk8sonlabVerified publisher1.1.71 of 7See more

librephotos k8sonlab 1.1.7

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
reallibrephotos/librephotos:1.2.1ecd7052f2b5f
pillow@12.3.0
13.0.0

Open the chart page →

18,634
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
pillow@12.1.1
13.0.0

Open the chart page →

9,145
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
pillow@11.2.1
13.0.0

Open the chart page →

2,423
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
pillow@11.3.0
13.0.0

Open the chart page →

2,199
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
pillow@12.1.1
13.0.0

Open the chart page →

1,656
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
pillow@12.2.0
13.0.0

Open the chart page →

4,436
bazarrm0nsterrr-bazarrVerified publisher2.4.01 of 1See more

bazarr m0nsterrr-bazarr 2.4.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
pillow@12.3.0
13.0.0

Open the chart page →

707
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
pillow@11.1.0
13.0.0

Open the chart page →

64,688
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
pillow@11.3.0
13.0.0

Open the chart page →

14,677
szurubooru-servermy0nVerified publisher0.2.51 of 3See more

szurubooru-server my0n 0.2.5

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
szurubooru/server:2.5accf2ad9fbc3
pillow@11.2.1
13.0.0

Open the chart page →

1,814
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
pillow@11.1.0
13.0.0

Open the chart page →

9,716
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
pillow@12.3.0
13.0.0

Open the chart page →

4,194
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
pillow@12.3.0
13.0.0

Open the chart page →

4,185
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
pillow@12.3.0
13.0.0

Open the chart page →

5,382
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

5,853
ctfdpascaliskeVerified publisher2.0.01 of 1See more

ctfd pascaliske 2.0.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
pillow@11.3.0
13.0.0

Open the chart page →

3,079
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
pillow@12.0.0
13.0.0

Open the chart page →

7,094
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0

Open the chart page →

6,553
delugeretsamedocVerified publisher26.9.01 of 1See more

deluge retsamedoc 26.9.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
linuxserver/deluge:2.2.0bf306ddd5e6d
pillow@12.3.0
13.0.0

Open the chart page →

563
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
pillow@11.1.0
13.0.0

Open the chart page →

5,213
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
pillow@11.1.0
13.0.0

Open the chart page →

12,612
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
pillow@12.3.0
13.0.0

Open the chart page →

2,284
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
pillow@12.2.0
13.0.0

Open the chart page →

10,136
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
pillow@11.3.0
13.0.0

Open the chart page →

13,441
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0

Open the chart page →

5,751
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
pillow@12.2.0
13.0.0

Open the chart page →

2,605
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
pillow@12.2.0
13.0.0
safeglobal/safe-transaction-service:latest7b576c73f865
pillow@12.3.0
13.0.0

Open the chart page →

105,777
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
pillow@12.3.0
13.0.0

Open the chart page →

101,766
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0

Open the chart page →

4,019
otterwikischmitzis0.1.01 of 1See more

otterwiki schmitzis 0.1.0

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
redimp/otterwiki:2b7ece5b8d7cc
pillow@12.3.0
13.0.0

Open the chart page →

3,135
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0

Open the chart page →

45,095
search-proxysearch-proxy2026.42.31 of 1See more

search-proxy search-proxy 2026.42.3

1 of the 1 container images this version deploys carry GHSA-78g4-xqwv-q3g8.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
pillow@12.2.0
13.0.0

Open the chart page →

2,257

Container images carrying it

136 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
pillow@12.0.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0
1
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
pillow@12.3.0
13.0.0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
pillow@12.2.0
13.0.0
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
pillow@11.2.1
13.0.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
pillow@12.1.1
13.0.0
1
ghcr.io/immich-app/immich-machine-learning:v3.3.41ab8674e7cec
pillow@12.3.0
13.0.0
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0
1
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
pillow@11.3.0
13.0.0
1
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
pillow@12.1.1
13.0.0
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
pillow@11.3.0
13.0.0
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0
1
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
pillow@12.3.0
13.0.0
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
pillow@11.3.0
13.0.0
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
pillow@12.3.0
13.0.0
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
pillow@12.1.1
13.0.0
1
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
pillow@12.3.0
13.0.0
1
ghcr.io/opendatacube/ows:1.9.17de29324e9801
pillow@12.3.0
13.0.0
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
pillow@12.3.0
13.0.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
pillow@11.3.0
13.0.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
pillow@11.3.0
13.0.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pillow@11.3.0
13.0.0
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
pillow@11.3.0
13.0.0
1
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
pillow@12.3.0
13.0.0
1
ghcr.io/securo-finance/securo-backend:0.16.50e40c6858fb3
pillow@12.3.0
13.0.0
1
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
pillow@11.3.0
13.0.0
1
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
pillow@12.2.0
13.0.0
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
pillow@11.2.1
13.0.0
1
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pillow@12.3.0
13.0.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
pillow@12.2.0
13.0.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
pillow@11.1.0
13.0.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
pillow@11.1.0
13.0.0
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
pillow@12.0.0
13.0.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
pillow@12.2.0
13.0.0
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.