StackRadar

GHSA-g7r4-m6w7-qqqr

Low

Advisory

Published 12 Jun 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
18
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
1 of 1
affected package

esbuild allows arbitrary file read when running the development server on Windows

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
esbuildnpm0.27.3, 0.27.4, 0.27.7, 0.28.00.28.118
OSV records
GHSA-g7r4-m6w7-qqqr

Charts affected

18 by stars
ChartLatestAffected imagesRadar Score
docmosthelmforgeVerified publisher1.2.111 of 4See more

docmost helmforge 1.2.11

1 of the 4 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
docmost/docmost:0.95.041c8d777cf23
esbuild@0.28.0
0.28.1

Open the chart page →

5,564
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
esbuild@0.27.7
0.28.1

Open the chart page →

9,460
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
esbuild@0.27.4
0.28.1

Open the chart page →

4,016
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
esbuild@0.27.3
0.28.1

Open the chart page →

1,044
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
esbuild@0.27.3
0.28.1

Open the chart page →

7,473
immichsecustorVerified publisher2.0.41 of 1See more

immich secustor 2.0.4

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
esbuild@0.27.4
0.28.1

Open the chart page →

3,059
discord-botxxczakiVerified publisher0.27.51 of 2See more

discord-bot xxczaki 0.27.5

1 of the 2 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
xxczaki/discord-bot:e9f46b6aebac02e7b96ed41a3f62b26e871cf009bb919aac45dc
esbuild@0.27.7
0.28.1

Open the chart page →

474
adeptia-automate-mcpadeptia-automate-mcp1.0.01 of 2See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

1 of the 2 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
esbuild@0.27.3
0.28.1

Open the chart page →

3,600
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
esbuild@0.27.7
0.28.1

Open the chart page →

1,055
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
esbuild@0.27.7
0.28.1

Open the chart page →

523
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
esbuild@0.27.4
0.28.1

Open the chart page →

4,259
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
esbuild@0.27.4
0.28.1

Open the chart page →

11,042
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
esbuild@0.27.7
0.28.1

Open the chart page →

2,538
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
esbuild@0.28.0
0.28.1

Open the chart page →

1,852
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
esbuild@0.27.4
0.28.1

Open the chart page →

3,798
etherpadschoenwald0.3.01 of 1See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
etherpad/etherpad:2.7.2b723fe5f2594
esbuild@0.27.7
0.28.1

Open the chart page →

2,133
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
esbuild@0.27.7
0.28.1

Open the chart page →

3,972
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-g7r4-m6w7-qqqr.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
esbuild@0.27.3
0.28.1

Open the chart page →

4,305

Container images carrying it

18 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
activepieces/activepieces:0.90.430c10a04fe3d
esbuild@0.27.7
0.28.1
1
adeptiainc/adeptia-automate-mcp-server:1.0.0283001e83739
esbuild@0.27.3
0.28.1
1
directus/directus:12.0.29c8470ea465c
esbuild@0.27.3
0.28.1
1
docmost/docmost:0.95.041c8d777cf23
esbuild@0.28.0
0.28.1
1
drumsergio/genieacs:1.2.16.028244054e1bf
esbuild@0.27.4
0.28.1
1
drumsergio/lynxprompt:2.0.75c6afb6679301
esbuild@0.28.0
0.28.1
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
esbuild@0.27.7
0.28.1
1
etherpad/etherpad:2.7.2b723fe5f2594
esbuild@0.27.7
0.28.1
1
nocodb/nocodb:0.301.5d9516f0bf546
esbuild@0.27.4
0.28.1
1
tensorzero/ui:2026.6.0f2563d54724e
esbuild@0.27.7
0.28.1
1
xxczaki/discord-bot:e9f46b6aebac02e7b96ed41a3f62b26e871cf009bb919aac45dc
esbuild@0.27.7
0.28.1
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
esbuild@0.27.4
0.28.1
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
esbuild@0.27.3
0.28.1
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
esbuild@0.27.4
0.28.1
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
esbuild@0.27.4
0.28.1
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
esbuild@0.27.7
0.28.1
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
esbuild@0.27.7
0.28.1
1
ghcr.io/wgbh-mla/dream-aapb:main288a4774aa90
esbuild@0.27.3
0.28.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.