GHSA-f8fg-pg57-v4j8
HighAdvisory
Published 1 Sept 2026In the index since 9 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.2
- base score, highest
- EPSS
- 0.002
- 13th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 16
- of 17,781 indexed, latest versions
- Container images
- 15
- deployed by those charts
- Fix available
- 1 of 1
- affected package
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Carried by container images the latest versions of 16 of 17,781 indexed charts deploy, on 15 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| league/ | 2.7.1, 2.8.0, 2.8.1, 2.8.2+1 more | 2.9.1 | 15 |
- OSV records
- GHSA-f8fg-pg57-v4j8
- Also known as
- CVE-2026-86431
Charts affected
16 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| monicamonicaOfficialVerified publisher | 1.0.15 | 1 of 1See more | 5,634 |
| bookstackbookstack-mgVerified publisher | 0.3.1 | 1 of 2See more | 1,896 |
| akauntingf3k-techVerified publisher | 1.3121.0 | 1 of 4See more | 4,333 |
| glpikitsune-itopsVerified publisher | 1.0.7 | 1 of 3See more | 4,802 |
| linkstackadnoctemVerified publisher | 0.4.0 | 1 of 1See more | 2,092 |
| cspconsolecspconsole | 1.3.11 | 1 of 5See more | 12,274 |
| webtreesdjjudas21Verified publisher | 3.0.0 | 1 of 1See more | 5,966 |
| firefly-iiifirefly-iii | 1.10.1 | 1 of 1See more | 5,039 |
| firefly-iii-stackfirefly-iii | 0.10.2 | 2 of 4See more | 10,260 |
| importerfirefly-iii | 1.6.0 | 1 of 1See more | 4,829 |
| castopodhelmforgeVerified publisher | 1.2.7 | 1 of 3See more | 9,342 |
| heimdallhelmforgeVerified publisher | 1.1.14 | 1 of 1See more | 438 |
| firefly-iiikubernetes-homelab-helm-chartsVerified publisher | 0.1.3 | 1 of 3See more | 4,382 |
| librenmslibrenms | 10.1.1 | 1 of 5See more | 3,126 |
| snipeitschmitzis | 6.1.0 | 1 of 2See more | 6,094 |
| xboardxboard | 0.2.0 | 1 of 1See more | 1,042 |
Container images carrying it
15 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| fireflyiii/ | fe4ecec4c2ba | league/ | 2.9.1 | 2 |
| fireflyiii/ | ab52bf932546 | league/ | 2.9.1 | 2 |
| akaunting/ | e7d5c245b1a0 | league/ | 2.9.1 | 1 |
| castopod/ | 4e4f0440520f | league/ | 2.9.1 | 1 |
| cspconsole/ | 46dda4a31bd6 | league/ | 2.9.1 | 1 |
| fireflyiii/ | ae69fdd95cde | league/ | 2.9.1 | 1 |
| glpi/ | 4b681082a79e | league/ | 2.9.1 | 1 |
| librenms/ | 8194a4a9ff49 | league/ | 2.9.1 | 1 |
| linkstackorg/ | 1c8b05399ee4 | league/ | 2.9.1 | 1 |
| linuxserver/ | 2ebf97852661 | league/ | 2.9.1 | 1 |
| linuxserver/ | 287e48152967 | league/ | 2.9.1 | 1 |
| snipe/ | 141ebf2386fe | league/ | 2.9.1 | 1 |
| ghcr.io/ | 896e4926e0d7 | league/ | 2.9.1 | 1 |
| ghcr.io/ | 8be69156acbb | league/ | 2.9.1 | 1 |
| ghcr.io/ | 034151b61a80 | league/ | 2.9.1 | 1 |