StackRadar

GHSA-gj48-438w-jh9v

Medium

Advisory

Published 16 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
65
of 17,781 indexed, latest versions
Container images
62
deployed by those charts
Fix available
1 of 1
affected package

Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes

Carried by container images the latest versions of 65 of 17,781 indexed charts deploy, on 62 images.

Affected packageAffected versionsFixed inImages
bleachpypi1.5.0, 2.1.2, 3.0.2, 3.1.0+12 more6.4.062
OSV records
GHSA-gj48-438w-jh9v

Charts affected

65 by stars
ChartLatestAffected imagesRadar Score
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
bleach@6.0.0
6.4.0

Open the chart page →

7,356
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
bleach@5.0.1
6.4.0

Open the chart page →

2,765
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
bleach@6.1.0
6.4.0

Open the chart page →

37,942
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
bleach@6.3.0
6.4.0

Open the chart page →

11,950
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
bleach@6.3.0
6.4.0

Open the chart page →

4,749
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
bleach@6.3.0
6.4.0

Open the chart page →

3,854
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
bleach@4.1.0
6.4.0

Open the chart page →

22,084
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
bleach@6.2.0
6.4.0

Open the chart page →

9,256
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
bleach@6.3.0
6.4.0

Open the chart page →

10,605
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
bleach@6.2.0
6.4.0

Open the chart page →

4,499
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
bleach@3.1.1
6.4.0

Open the chart page →

8,694
studygovernorstudy-governorVerified publisher0.1.381 of 3See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
registry.gitlab.com/radiology/infrastructure/study-governor:8.0.04e7faf6f8d5f
bleach@5.0.1
6.4.0

Open the chart page →

1,447
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
bleach@4.1.0
6.4.0

Open the chart page →

5,321
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
bleach@6.0.0
6.4.0

Open the chart page →

3,164
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-gj48-438w-jh9v.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
bleach@6.1.0
6.4.0

Open the chart page →

7,628

Container images carrying it

62 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
amancevice/superset:0.35.212a0a9e66550
bleach@3.1.0
6.4.0
2
cs3org/wopiserver:v9.4.202a9e78757b4
bleach@6.0.0
6.4.0
2
taigaio/taiga-back:latest4beed8f62c9f
bleach@4.1.0
6.4.0
2
weblate/weblate:4.2.2-169c160d37a3c
bleach@3.1.5
6.4.0
2
amancevice/superset:0.28.1c8c04bfe3d66
bleach@2.1.2
6.4.0
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
bleach@3.3.1
6.4.0
1
aristidetm/basic-notebook:3.6.5469dbc951224
bleach@6.1.0
6.4.0
1
cheyang/distributed-tf:1.6.046cc34755493
bleach@1.5.0
6.4.0
1
daskdev/dask-notebook:1.1.0052630f5ca04
bleach@3.0.2
6.4.0
1
datamate/seafile-professional:11.0.202dd66b722464
bleach@5.0.1
6.4.0
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
bleach@6.2.0
6.4.0
1
heartexlabs/label-studio:latestaa461572e8f9
bleach@5.0.1
6.4.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
bleach@6.1.0
6.4.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
bleach@6.1.0
6.4.0
1
improwised/erpnext-worker:v13.4.197280b55cbd4
bleach@3.3.0
6.4.0
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
bleach@6.0.0
6.4.0
1
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
bleach@3.2.1
6.4.0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
bleach@6.3.0
6.4.0
1
kyso/kyso-nbdime:latest4aa9d38ee81d
bleach@5.0.1
6.4.0
1
linuxserver/calibre-web:0.6.24241009026e6f
bleach@6.1.0
6.4.0
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
bleach@6.2.0
6.4.0
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
bleach@4.1.0
6.4.0
1
matrixdotorg/synapse:v1.78.0def97fd537d8
bleach@6.0.0
6.4.0
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
bleach@3.1.0
6.4.0
1
netboxcommunity/netbox:v3.2.83d652dca5351
bleach@5.0.1
6.4.0
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
bleach@6.1.0
6.4.0
1
opencsghq/label-studio:v2.5.047e22aa71870
bleach@5.0.1
6.4.0
1
opencsghq/label-studio:v2.4.0b4e849fcf94a
bleach@5.0.1
6.4.0
1
openzaak/open-zaak:1.6.02ca2ea6e0ae9
bleach@4.1.0
6.4.0
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
bleach@4.1.0
6.4.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
bleach@6.1.0
6.4.0
1
robmarkcole/deepstack-ui:latest410275726459
bleach@4.1.0
6.4.0
1
seafileltd/seafile-mc:9.0.106693911bcc40
bleach@4.1.0
6.4.0
1
seafileltd/seafile-mc:10.0.170628f29c663
bleach@5.0.1
6.4.0
1
seafileltd/seafile-mc:9.0.97ac833196f60
bleach@4.1.0
6.4.0
1
seafileltd/seafile-mc:11.0.12d0c66e4621bd
bleach@5.0.1
6.4.0
1
sissbruecker/linkding:1.35.00c5dddf0b37c
bleach@6.1.0
6.4.0
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
bleach@6.1.0
6.4.0
1
statcan/ckan:2.93921305425b8
bleach@3.1.4
6.4.0
1
taigaio/taiga-back:6.4.29f97323cc150
bleach@3.3.0
6.4.0
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
bleach@1.5.0
6.4.0
1
vabene1111/recipes:2.3.50f8d061895e9
bleach@6.2.0
6.4.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
bleach@4.1.0
6.4.0
1
weblate/weblate:3.11.3-182848df56ecd
bleach@3.1.1
6.4.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
bleach@6.1.0
6.4.0
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
bleach@6.1.0
6.4.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
bleach@6.2.0
6.4.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
bleach@6.3.0
6.4.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
bleach@6.1.0
6.4.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
bleach@6.3.0
6.4.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.