StackRadar

GHSA-hq85-5cpj-mr62

Critical

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
60
of 18,208 indexed, latest versions
Container images
58
deployed by those charts
Fix available
1 of 1
affected package

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Carried by container images the latest versions of 60 of 18,208 indexed charts deploy, on 58 images.

Affected packageAffected versionsFixed inImages
uvpypi0.4.1, 0.4.29, 0.5.6, 0.5.27+35 more0.13.458
OSV records
GHSA-hq85-5cpj-mr62
Also known as
PYSEC-2026-4321

Charts affected

60 by stars
ChartLatestAffected imagesRadar Score
home-assistanthelm-hassVerified publisher0.3.871 of 1See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
uv@0.12.23
0.13.4

Open the chart page →

3,196
dagsterdagsterVerified publisher1.13.262 of 5See more

dagster dagster 1.13.26

2 of the 5 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
dagster/dagster-celery-k8s:1.13.26605d41ae6647
uv@0.13.0
0.13.4
dagster/user-code-example:1.13.265c98e09b2aeb
uv@0.13.0
0.13.4

Open the chart page →

4,162
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.13.4

Open the chart page →

84,023
difydify-helmVerified publisher0.39.04 of 11See more

dify dify-helm 0.39.0

4 of the 11 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
uv@0.8.9
0.13.4
langgenius/dify-agent-local-sandbox:1.17.0316279a82ead
uv@0.8.9
0.13.4
langgenius/dify-api:1.17.052be6088dd84
uv@0.8.9
0.13.4
langgenius/dify-plugin-daemon:0.6.10-local34412a22d1e1
uv@0.12.2
0.13.4

Open the chart page →

63,506
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.13.4

Open the chart page →

24,506
home-assistantalekcVerified publisher2.12.21 of 1See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
uv@0.12.23
0.13.4

Open the chart page →

3,196
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
uv@0.12.5
0.13.4

Open the chart page →

3,705
dagster-user-deploymentsdagsterVerified publisher1.13.261 of 1See more

dagster-user-deployments dagster 1.13.26

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
dagster/user-code-example:1.13.265c98e09b2aeb
uv@0.13.0
0.13.4

Open the chart page →

776
zenmlzenml0.98.01 of 1See more

zenml zenml 0.98.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
zenmldocker/zenml-server:0.98.06a03880ace49
uv@0.13.1
0.13.4

Open the chart page →

1,259
dyff-apidyff-apiVerified publisher0.57.161 of 1See more

dyff-api dyff-api 0.57.16

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-api:0.57.16dffe548b3c53
uv@0.13.3
0.13.4

Open the chart page →

1,288
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
uv@0.12.23
0.13.4

Open the chart page →

3,420
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.13.4

Open the chart page →

6,252
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
uv@0.13.1
0.13.4

Open the chart page →

5,023
dagster-cloud-agentdagster-cloudVerified publisher1.13.261 of 1See more

dagster-cloud-agent dagster-cloud 1.13.26

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
uv@0.13.0
0.13.4

Open the chart page →

1,334
eoapieoapiOfficialVerified publisher0.17.31 of 7See more

eoapi eoapi 0.17.3

1 of the 7 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
uv@0.12.0
0.13.4

Open the chart page →

5,322
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest33afb0659d78
uv@0.12.23
0.13.4

Open the chart page →

3,196
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.13.4

Open the chart page →

8,239
home-assistantloeken-at-homeVerified publisher2026.9.21 of 1See more

home-assistant loeken-at-home 2026.9.2

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.9.2b1dff5b4c593
uv@0.12.5
0.13.4

Open the chart page →

2,513
home-assistantpree-helm-chartsVerified publisher1.85.01 of 1See more

home-assistant pree-helm-charts 1.85.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
uv@0.12.23
0.13.4

Open the chart page →

3,196
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
uv@0.11.14
0.13.4

Open the chart page →

10,479
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.13.4
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.13.4

Open the chart page →

20,955
waldurwaldur-chartsVerified publisher8.1.31 of 3See more

waldur waldur-charts 8.1.3

1 of the 3 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.382e8f276c5ed
uv@0.13.0
0.13.4

Open the chart page →

4,281
esphomealekcVerified publisher2.9.11 of 1See more

esphome alekc 2.9.1

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.13.4

Open the chart page →

3,815
music-assistant-serverandibraeuVerified publisher2.1.71 of 1See more

music-assistant-server andibraeu 2.1.7

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
uv@0.13.1
0.13.4

Open the chart page →

5,023
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.13.4

Open the chart page →

31,177
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.13.4

Open the chart page →

18,449
kube-acp-stackcloudentity2.29.11 of 7See more

kube-acp-stack cloudentity 2.29.1

1 of the 7 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.13.4

Open the chart page →

25,344
galaxycloudve6.8.91 of 3See more

galaxy cloudve 6.8.9

1 of the 3 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
uv@0.12.1
0.13.4

Open the chart page →

7,774
csghubcsghubVerified publisher2.6.02 of 35See more

csghub csghub 2.6.0

2 of the 35 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
uv@0.7.20
0.13.4
opencsghq/csgbot:v0.6.9-ee7d0271e26521
uv@0.12.13
0.13.4

Open the chart page →

68,013
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
uv@0.12.10
0.13.4

Open the chart page →

2,920
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:main-local4b07ca30ab2a
uv@0.12.23
0.13.4

Open the chart page →

56,473
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
uv@0.10.1
0.13.4

Open the chart page →

3,815
home-assistantegebackVerified publisher2.0.371 of 1See more

home-assistant egeback 2.0.37

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
uv@0.12.23
0.13.4

Open the chart page →

3,196
emissary-ingressemissary-ingress4.1.01 of 1See more

emissary-ingress emissary-ingress 4.1.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
uv@0.11.15
0.13.4

Open the chart page →

1,538
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
uv@0.10.1
0.13.4

Open the chart page →

3,815
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.13.4

Open the chart page →

6,238
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
uv@0.12.10
0.13.4

Open the chart page →

2,920
archiveboxhelmforgeVerified publisher1.1.151 of 1See more

archivebox helmforge 1.1.15

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
uv@0.11.29
0.13.4

Open the chart page →

6,233
chiefonboardinghelmforgeVerified publisher1.1.171 of 3See more

chiefonboarding helmforge 1.1.17

1 of the 3 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
uv@0.12.12
0.13.4

Open the chart page →

8,842
openreplayhelmforgeVerified publisher1.1.12 of 24See more

openreplay helmforge 1.1.1

2 of the 24 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
public.ecr.aws/p1t3u8a3/alerts:v1.28.0048f3090de46
uv@0.12.19
0.13.4
public.ecr.aws/p1t3u8a3/chalice:v1.28.66abe7250a64e
uv@0.12.23
0.13.4

Open the chart page →

15,737
supersethelmforgeVerified publisher1.4.21 of 5See more

superset helmforge 1.4.2

1 of the 5 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
uv@0.12.10
0.13.4

Open the chart page →

6,746
inventreeinventreeOfficialVerified publisher0.4.331 of 2See more

inventree inventree 0.4.33

1 of the 2 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
inventree/inventree:1.6.098e608cffe7f
uv@0.11.29
0.13.4

Open the chart page →

5,941
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.13.4

Open the chart page →

5,648
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
0.13.4

Open the chart page →

8,734
mqtt-to-stuffleprechaun-charts0.1.821 of 1See more

mqtt-to-stuff leprechaun-charts 0.1.82

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/leprechaun/mqtt-to-stuff:0.1.82a02099acd3ee
uv@0.13.1
0.13.4

Open the chart page →

682
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
uv@0.11.25
0.13.4

Open the chart page →

4,002
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
uv@0.5.6
0.13.4

Open the chart page →

7,232
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.13.4

Open the chart page →

6,566
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
uv@0.11.13
0.13.4

Open the chart page →

2,144
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-hq85-5cpj-mr62.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
uv@0.10.1
0.13.4

Open the chart page →

3,867

Container images carrying it

58 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.13.4
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
uv@0.12.24
0.13.4
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
uv@0.11.11
0.13.4
1
ghcr.io/stac-utils/pgstac-pypgstac:v0.9.12672faad776b5
uv@0.12.0
0.13.4
1
public.ecr.aws/p1t3u8a3/alerts:v1.28.0048f3090de46
uv@0.12.19
0.13.4
1
public.ecr.aws/p1t3u8a3/chalice:v1.28.66abe7250a64e
uv@0.12.23
0.13.4
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
uv@0.12.1
0.13.4
1
registry.gitlab.com/dyff/dyff-api:0.57.16dffe548b3c53
uv@0.13.3
0.13.4
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.