StackRadar

GHSA-9q82-xgwf-vj6h

Medium

Advisory

Published 26 Mar 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
38
of 17,781 indexed, latest versions
Container images
36
deployed by those charts
Fix available
1 of 2
affected packages

Apollo Server: Browser bug allows for bypass of XS-Search (read-only Cross-Site Request Forgery) prevention

Carried by container images the latest versions of 38 of 17,781 indexed charts deploy, on 36 images.

Affected packageAffected versionsFixed inImages
apollo-server-corenpm1.3.6, 2.14.2, 2.16.1, 2.18.2+10 moreno fix listed28
@apollo/servernpm4.6.0, 4.7.4, 4.9.5, 4.11.0+1 more5.5.08
OSV records
GHSA-9q82-xgwf-vj6h

Charts affected

38 by stars
ChartLatestAffected imagesRadar Score
sorry-cypresssorry-cypressVerified publisher1.20.01 of 4See more

sorry-cypress sorry-cypress 1.20.0

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-api:2.5.11afaa5a84051d
apollo-server-core@3.12.1
no fix listed

Open the chart page →

4,285
backstagedeliveryheroVerified publisher0.1.151 of 2See more

backstage deliveryhero 0.1.15

1 of the 2 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
apollo-server-core@2.16.1
no fix listed

Open the chart page →

8,213
wikijsgeek-cookbookVerified publisher6.4.21 of 1See more

wikijs geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
apollo-server-core@2.22.2
no fix listed

Open the chart page →

5,946
graphql-gatewaygraphql-gatewayVerified publisher0.1.51 of 1See more

graphql-gateway graphql-gateway 0.1.5

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
hansehe/graphql-gateway:1.0.458e09540afbc
apollo-server-core@2.18.2
no fix listed

Open the chart page →

1,660
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@apollo/server@4.9.5
5.5.0

Open the chart page →

3,451
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
apollo-server-core@1.3.6
no fix listed

Open the chart page →

17,896
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
@apollo/server@4.11.0
5.5.0

Open the chart page →

10,380
ackeesudaVerified publisher0.2.11 of 1See more

ackee suda 0.2.1

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
electerious/ackee:3.2.05e7173fa321c
apollo-server-core@2.25.2
no fix listed

Open the chart page →

1,602
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
apollo-server-core@2.26.2
no fix listed

Open the chart page →

3,833
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
apollo-server-core@3.11.1
no fix listed

Open the chart page →

4,455
mod-graphqlfolio-org0.1.301 of 1See more

mod-graphql folio-org 0.1.30

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
folioci/mod-graphql:latestf0655a6a08fd
@apollo/server@4.12.2
5.5.0

Open the chart page →

1,091
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
apollo-server-core@2.14.2
no fix listed
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
apollo-server-core@2.14.2
no fix listed
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
apollo-server-core@2.14.2
no fix listed
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
apollo-server-core@2.14.2
no fix listed

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
apollo-server-core@2.16.1
no fix listed

Open the chart page →

8,213
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@apollo/server@4.9.5
5.5.0

Open the chart page →

3,451
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
apollo-server-core@2.25.2
no fix listed

Open the chart page →

4,253
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
@apollo/server@4.11.0
5.5.0

Open the chart page →

3,614
interbtc-hydrainterlay0.1.151 of 4See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
apollo-server-core@3.4.0
no fix listed

Open the chart page →

6,831
interlay-firesquidinterlay0.1.112 of 4See more

interlay-firesquid interlay 0.1.11

2 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
interlayhq/interbtc-hydra-processor:0.10.55b2c414307b9
apollo-server-core@3.10.2
no fix listed
subsquid/substrate-explorer:firesquid0889a857f192
apollo-server-core@3.11.1
no fix listed

Open the chart page →

4,667
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
apollo-server-core@2.25.2
no fix listed

Open the chart page →

7,232
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
apollo-server-core@3.6.3
no fix listed

Open the chart page →

4,230
component-storekubebb0.0.231 of 1See more

component-store kubebb 0.0.23

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
kubebb/component-store:latestfd8ecbd73213
@apollo/server@4.7.4
5.5.0

Open the chart page →

2,178
u4a-componentkubebb0.2.101 of 8See more

u4a-component kubebb 0.2.10

1 of the 8 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
kubebb/bff-server:v0.2.0-202312040fbb732379bc
apollo-server-core@3.9.0
no fix listed

Open the chart page →

13,819
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
apollo-server-core@2.19.2
no fix listed

Open the chart page →

68,284
opsportalmesosphere-stable0.9.51 of 3See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
mesosphere/kommander:6.100.13917e82333a9
apollo-server-core@2.19.2
no fix listed

Open the chart page →

7,027
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
@apollo/server@4.6.0
5.5.0

Open the chart page →

14,809
reporting-hub-bop-api-svcmojaloop4.1.31 of 1See more

reporting-hub-bop-api-svc mojaloop 4.1.3

1 of the 1 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
@apollo/server@4.6.0
5.5.0

Open the chart page →

1,661
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
apollo-server-core@2.25.2
no fix listed

Open the chart page →

9,968
sorry-cypresssoftonic1.20.01 of 4See more

sorry-cypress softonic 1.20.0

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
agoldis/sorry-cypress-api:2.5.11afaa5a84051d
apollo-server-core@3.12.1
no fix listed

Open the chart page →

4,285
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
apollo-server-core@3.12.1
no fix listed

Open the chart page →

16,368
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
apollo-server-core@3.12.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testingspeckleVerified publisher2.17.14-branch.testing.72707.921a5f81 of 5See more

speckle-server-branch-testing speckle 2.17.14-branch.testing.72707.921a5f8

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
apollo-server-core@3.12.1
no fix listed

Open the chart page →

14,679
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
apollo-server-core@3.12.1
no fix listed

Open the chart page →

16,400
speckle-server-branch-testing2speckleVerified publisher2.18.11-branch.testing2.88634-335d4691 of 5See more

speckle-server-branch-testing2 speckle 2.18.11-branch.testing2.88634-335d469

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
apollo-server-core@3.12.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing3speckleVerified publisher2.18.12-branch.testing3.88744-f55b3411 of 5See more

speckle-server-branch-testing3 speckle 2.18.12-branch.testing3.88744-f55b341

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
apollo-server-core@3.12.1
no fix listed

Open the chart page →

14,221
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
apollo-server-core@3.12.1
no fix listed

Open the chart page →

16,019
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
@apollo/server@4.11.0
5.5.0

Open the chart page →

15,635
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
@apollo/server@4.11.0
5.5.0

Open the chart page →

11,100
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-9q82-xgwf-vj6h.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
apollo-server-core@2.26.2
no fix listed

Open the chart page →

5,459

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
agoldis/sorry-cypress-api:2.5.11afaa5a84051d
apollo-server-core@3.12.1
no fix listed
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
@apollo/server@4.9.5
5.5.0
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
apollo-server-core@2.16.1
no fix listed
2
mesosphere/kommander:6.100.13917e82333a9
apollo-server-core@2.19.2
no fix listed
2
mojaloop/reporting-hub-bop-api-svc:v4.1.2b45a2d6f0f2a
@apollo/server@4.6.0
5.5.0
2
requarks/wiki:2:latest68f0d1848261
apollo-server-core@2.26.2
no fix listed
2
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
apollo-server-core@1.3.6
no fix listed
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
apollo-server-core@3.11.1
no fix listed
1
electerious/ackee:3.2.05e7173fa321c
apollo-server-core@2.25.2
no fix listed
1
folioci/mod-graphql:latestf0655a6a08fd
@apollo/server@4.12.2
5.5.0
1
hansehe/graphql-gateway:1.0.458e09540afbc
apollo-server-core@2.18.2
no fix listed
1
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
@apollo/server@4.11.0
5.5.0
1
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
apollo-server-core@3.4.0
no fix listed
1
interlayhq/interbtc-hydra-processor:0.10.55b2c414307b9
apollo-server-core@3.10.2
no fix listed
1
kubebb/bff-server:v0.2.0-202312040fbb732379bc
apollo-server-core@3.9.0
no fix listed
1
kubebb/component-store:latestfd8ecbd73213
@apollo/server@4.7.4
5.5.0
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
apollo-server-core@3.6.3
no fix listed
1
requarks/wiki:canary-2.5.2438b5865a7386c
apollo-server-core@2.25.2
no fix listed
1
roadiehq/community-backstage-image:latestef355bf5b639
apollo-server-core@2.25.2
no fix listed
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
@apollo/server@4.11.0
5.5.0
1
speckle/speckle-server:2.26.379f14a2bf931
@apollo/server@4.11.0
5.5.0
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
@apollo/server@4.11.0
5.5.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
apollo-server-core@3.12.1
no fix listed
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
apollo-server-core@3.12.1
no fix listed
1
subsquid/substrate-explorer:firesquid0889a857f192
apollo-server-core@3.11.1
no fix listed
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
apollo-server-core@2.14.2
no fix listed
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
apollo-server-core@2.14.2
no fix listed
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
apollo-server-core@2.14.2
no fix listed
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
apollo-server-core@2.14.2
no fix listed
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
apollo-server-core@2.22.2
no fix listed
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
apollo-server-core@2.25.2
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.