StackRadarChart IndexLive demo

GHSA-9v8h-qqgm-4m35

Critical

Advisory

Published 22 Oct 2026In the index since 24 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.2; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 127; of 18,232 indexed, latest versions
Container images: 110; deployed by those charts
Fix available: 2 of 2; affected packages

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

Carried by container images the latest versions of 127 of 18,232 indexed charts deploy, on 110 images.

Affected package	Affected versions	Fixed in	Images
brotlipypi	1.0.9, 1.1.0, 1.2.0	1.2.1	107
brotlicffipypi	1.2.0.1, 1.2.0.2	1.2.1.0	3

OSV records: GHSA-9v8h-qqgm-4m35

Charts affected

127 by stars

Chart

Latest

Affected images

Radar Score

1 of 1 See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.18	c332c5f6dfba	brotli@1.2.0	1.2.1

Open the chart page →

644

clearmlallegroai

1 of 4 See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
allegroai/clearml :2.0.0-613	713ae38f7daf	brotli@1.1.0	1.2.1

Open the chart page →

73,887

weblateweblate

1 of 3 See more

weblate weblate 0.5.44

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
weblate/weblate :2026.10.1.2	6663a7c8b444	brotli@1.2.0	1.2.1

Open the chart page →

8,034

locustdeliveryhero

1 of 1 See more

locust deliveryhero 0.35.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
locustio/locust :2.32.2	a0d4b88e42c1	brotli@1.1.0	1.2.1

Open the chart page →

3,166

difydify-helm

1 of 11 See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
langgenius/dify-api :1.17.0	52be6088dd84	brotli@1.2.0	1.2.1

Open the chart page →

64,891

home-assistantgeek-cookbook

1 of 1 See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2022.5.4	ec6d67fbedfa	brotli@1.0.9	1.2.1

Open the chart page →

9,736

daskdask

2 of 2 See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/dask/dask :2024.1.0	080150de7d86	brotli@1.1.0	1.2.1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	brotli@1.1.0	1.2.1

Open the chart page →

15,679

homeassistantvolker-raschek

1 of 1 See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2023.12.4	8d000332b09b	brotli@1.1.0	1.2.1

Open the chart page →

8,090

paperless-ngxfmjstudios

1 of 5 See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.10.1	a132c2ac7c57	brotli@1.1.0	1.2.1

Open the chart page →

37,307

paperless-ngxpaperless-ngx

1 of 3 See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.3	dba0242c1df1	brotli@1.2.0	1.2.1

Open the chart page →

10,438

home-assistantandrenarchy

1 of 1 See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	brotli@1.2.0	1.2.1

Open the chart page →

4,398

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
baserow/backend :2.4.1	497347d0ba74	brotli@1.2.0	1.2.1

Open the chart page →

20,099

1 of 1 See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :latest	c332c5f6dfba	brotli@1.2.0	1.2.1

Open the chart page →

644

1 of 9 See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
pangeo/base-notebook :2024.01.15	5fbe688a4f80	brotli@1.1.0	1.2.1

Open the chart page →

18,630

changedetectionalekc

1 of 1 See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.9	04eaae7915ba	brotli@1.2.0	1.2.1

Open the chart page →

3,129

alerta-webalerta-web

1 of 2 See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
hayk96/alerta-web :9.0.4	86377705e9e3	brotli@1.1.0	1.2.1

Open the chart page →

5,022

convertigoconvertigo

1 of 5 See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
baserow/baserow :1.30.1	df0c42eb67e8	brotli@1.1.0	1.2.1

Open the chart page →

79,283

defectdojodefectdojo

1 of 4 See more

defectdojo defectdojo 1.9.60

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
defectdojo/defectdojo-django :3.4.202	b1c3fc5c295f	brotli@1.2.0	1.2.1

Open the chart page →

2,104

openshift-secured-pgadmineximiait

1 of 2 See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :7.5	37946e4f3e7b	brotli@1.0.9	1.2.1

Open the chart page →

16,105

hermes-agenthermes-agent

1 of 1 See more

hermes-agent hermes-agent 1.22.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v0.22.5	9c5561579f3f	brotlicffi@1.2.0.2	1.2.1.0

Open the chart page →

4,519

home-assistanthome-assistant

1 of 3 See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.10.2	33afb0659d78	brotli@1.2.0	1.2.1

Open the chart page →

4,129

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	brotli@1.2.0	1.2.1

Open the chart page →

7,392

home-assistantk8s-home-lab-repo

1 of 1 See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	brotli@1.2.0	1.2.1

Open the chart page →

6,889

skypilotskypilot

1 of 3 See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
berkeleyskypilot/skypilot :0.14.1	25577df35586	brotli@1.2.0	1.2.1

Open the chart page →

7,122

paperlesszekker6

1 of 1 See more

paperless zekker6 11.15.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.4	9bc6e8248891	brotli@1.2.0	1.2.1

Open the chart page →

5,588

paperless-ngxadnoctem

1 of 5 See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.2	d232cba37cc0	brotli@1.2.0	1.2.1

Open the chart page →

33,726

paperless-ngxalexmorbo-paperless-ngx

1 of 2 See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	brotli@1.1.0	1.2.1

Open the chart page →

15,607

hermes-agentankra-charts

1 of 1 See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	brotlicffi@1.2.0.1	1.2.1.0

Open the chart page →

8,783

music-assistantbdclark-helm-charts

1 of 1 See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/music-assistant/server :2.10.7	dce482dc3bf4	brotli@1.2.0	1.2.1

Open the chart page →

5,760

paperless-ngxcrystalnet

1 of 3 See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	brotli@1.1.0	1.2.1

Open the chart page →

17,068

eoapieoapi

1 of 7 See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/stac-utils/stac-fastapi-pgstac :7.1.0	8d546f480e46	brotli@1.2.0	1.2.1

Open the chart page →

5,915

home-assistantgabe565

1 of 1 See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :latest	33afb0659d78	brotli@1.2.0	1.2.1

Open the chart page →

3,855

obicogabe565

1 of 3 See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/gabe565/obico/web :latest	6acb4a5903eb	brotli@1.1.0	1.2.1

Open the chart page →

2,913

supersetinseefrlab

1 of 4 See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
apache/superset :9cdaa280429ec297db16d56c94fd77b5d2aff107	975ab033580d	brotli@1.0.9	1.2.1

Open the chart page →

9,838

difykubeblocks

1 of 5 See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
langgenius/dify-api :0.6.11	fca918260dd6	brotli@1.1.0	1.2.1

Open the chart page →

23,769

music-assistant-serverlmatfy

1 of 1 See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/music-assistant/server :2.7.5	3522e8a7a8f0	brotli@1.2.0	1.2.1

Open the chart page →

9,005

locustlocust

1 of 1 See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
hansehe/locust :1.1.0	bc8e45262bc4	brotli@1.1.0	1.2.1

Open the chart page →

3,286

home-assistantloeken-at-home

1 of 1 See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
loeken/home-assistant :2026.9.2	b1dff5b4c593	brotli@1.2.0	1.2.1

Open the chart page →

3,201

opentelemetry-demoopentelemetry-helm

2 of 34 See more

opentelemetry-demo opentelemetry-helm 0.42.6

2 of the 34 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :3.1.0-chatbot	604b1f493c92	brotli@1.2.0	1.2.1
ghcr.io/open-telemetry/demo :3.1.0-load-generator	b130d6cee6cb	brotli@1.2.0	1.2.1

Open the chart page →

29,432

palworldpalworld-server-chart

1 of 1 See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	brotli@1.2.0	1.2.1

Open the chart page →

4,760

paperless-ngxpaperless

1 of 3 See more

paperless-ngx paperless 0.4.1

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinned	9bc6e8248891	brotli@1.2.0	1.2.1

Open the chart page →

10,012

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	brotli@1.1.0	1.2.1

Open the chart page →

6,484

sentry-k8ssentry-k8s

2 of 11 See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	brotli@1.2.0	1.2.1
ghcr.io/getsentry/snuba :26.7.2	10f8d164109b	brotli@1.2.0	1.2.1

Open the chart page →

55,145

smarter-demosmarter

2 of 7 See more

smarter-demo smarter 0.1.5

2 of the 7 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	brotli@1.0.9	1.2.1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	brotli@1.0.9	1.2.1

Open the chart page →

248,275

alertasomeblackmagic

1 of 2 See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
alerta/alerta-web :8.5.0	4786b9eaa606	brotli@1.0.9	1.2.1

Open the chart page →

4,490

verbacapverbacap

1 of 1 See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	brotli@1.1.0	1.2.1

Open the chart page →

3,054

qleverzazuko

1 of 2 See more

qlever zazuko 0.7.2

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
ghcr.io/zazukoians/qlever-ui :v0.10.3	c27e20f7a2ca	brotli@1.2.0	1.2.1

Open the chart page →

2,816

akto-mini-testingakto

1 of 5 See more

akto-mini-testing akto 1.47.0

1 of the 5 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-ai-automated-testing :latest	3fde5f4a0c1d	brotli@1.2.0	1.2.1

Open the chart page →

5,663

1 of 1 See more

esphome alekc 2.10.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
esphome/esphome :2026.10.0	3a32372dfbd6	brotli@1.2.0	1.2.1

Open the chart page →

4,253

tubearchivistalexmorbo-tubearchivist

1 of 2 See more

tubearchivist alexmorbo-tubearchivist 0.1.0

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container image	Digest	Package	Fixed in
bbilly1/tubearchivist :v0.5.9	b827a713f55b	brotli@1.2.0	1.2.1

Open the chart page →

6,711

Container images carrying it

110 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	brotli@1.2.0	1.2.1	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	brotli@1.1.0	1.2.1	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	brotli@1.1.0	1.2.1	1
ghcr.io/quenchworks/images/pgadmin	c35f42c8210f	brotli@1.2.0	1.2.1	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	brotli@1.0.9	1.2.1	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	brotli@1.0.9	1.2.1	1
ghcr.io/stac-utils/stac-fastapi-pgstac :7.1.0	8d546f480e46	brotli@1.2.0	1.2.1	1
ghcr.io/zazukoians/qlever-ui :v0.10.3	c27e20f7a2ca	brotli@1.2.0	1.2.1	1
public.ecr.aws/aktosecurity/akto-ai-automated-testing :latest	3fde5f4a0c1d	brotli@1.2.0	1.2.1	1
quay.io/ortelius/ms-sbom-export :main-v10.0.933-g2e222e	f43bdaa51598	brotli@1.2.0	1.2.1	1