StackRadar

GHSA-mcm9-63f2-9j32

High

Advisory

Published 1 Oct 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,985 indexed, latest versions
Container images
30
deployed by those charts
Fix available
1 of 1
affected package

devalue: Repeated primitive strings cause quadratic expansion in uneval

Carried by container images the latest versions of 26 of 17,985 indexed charts deploy, on 30 images.

Affected packageAffected versionsFixed inImages
devaluenpm2.0.1, 4.3.2, 4.3.3, 5.0.0+7 more5.9.330
OSV records
GHSA-mcm9-63f2-9j32

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
openmined/syft-frontend:0.9.5d11524a3854a
devalue@4.3.2
5.9.3

Open the chart page →

20,661
baserowbaserow-chartVerified publisher1.1.01 of 6See more

baserow baserow-chart 1.1.0

1 of the 6 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
baserow/web-frontend:2.4.00d91358ed205
devalue@5.9.2
5.9.3

Open the chart page →

19,167
wg-easywg-easyVerified publisher0.1.61 of 1See more

wg-easy wg-easy 0.1.6

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:150e7bc9d34e86
devalue@5.9.0
5.9.3

Open the chart page →

1,046
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
devalue@2.0.1
5.9.3

Open the chart page →

17,216
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
devalue@2.0.1
5.9.3

Open the chart page →

9,096
data-fairdata354-helmVerified publisher1.1.26 of 12See more

data-fair data354-helm 1.1.2

6 of the 12 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
devalue@2.0.1
5.9.3
ghcr.io/data-fair/metrics:0a8d40779eeae
devalue@2.0.1
5.9.3
ghcr.io/data-fair/notify:3c739b74dabb0
devalue@2.0.1
5.9.3
ghcr.io/data-fair/portals:18b621866ceb2
devalue@2.0.1
5.9.3
ghcr.io/data-fair/processings:15a9216989707
devalue@2.0.1
5.9.3
ghcr.io/data-fair/simple-directory:438a4f32fad82
devalue@2.0.1
5.9.3

Open the chart page →

42,281
litlyxlitlyx0.2.01 of 5See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
litlyx/litlyx-dashboard:lateste64ff2d52385
devalue@5.5.0
5.9.3

Open the chart page →

9,506
wg-easyslybase-wg-easyVerified publisher1.2.01 of 1See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:15.4.00e7bc9d34e86
devalue@5.9.0
5.9.3

Open the chart page →

1,046
platform-uiappscodeVerified publisher2026.9.111 of 1See more

platform-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
devalue@5.7.1
5.9.3

Open the chart page →

810
astrotrekastria0.0.21 of 4See more

astrotrek astria 0.0.2

1 of the 4 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
devalue@4.3.2
5.9.3

Open the chart page →

36,124
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latest7e2ef5261764
devalue@5.8.2
5.9.3

Open the chart page →

8,289
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
devalue@5.8.1
5.9.3
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
devalue@5.8.1
5.9.3

Open the chart page →

3,802
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
devalue@5.6.4
5.9.3

Open the chart page →

4,480
elkrivals-spaceVerified publisher0.1.11 of 1See more

elk rivals-space 0.1.1

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/elk-zone/elk:main046dfdb8550c
devalue@5.6.4
5.9.3

Open the chart page →

470
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latest7e2ef5261764
devalue@5.8.2
5.9.3

Open the chart page →

8,289
s3-browsers3-browser0.4.11 of 1See more

s3-browser s3-browser 0.4.1

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
devalue@5.6.4
5.9.3

Open the chart page →

730
elk-frontendschoenwald0.2.221 of 1See more

elk-frontend schoenwald 0.2.22

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
devalue@5.6.4
5.9.3

Open the chart page →

589
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
devalue@2.0.1
5.9.3

Open the chart page →

4,395
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
devalue@5.0.0
5.9.3

Open the chart page →

17,937
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
devalue@5.0.0
5.9.3

Open the chart page →

18,022
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
devalue@5.0.0
5.9.3

Open the chart page →

18,022
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
devalue@5.0.0
5.9.3

Open the chart page →

17,590
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
devalue@5.0.0
5.9.3

Open the chart page →

17,270
codegentest-opea1.0.01 of 5See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
opea/codegen-ui:1.02bee4eb66f3e
devalue@4.3.3
5.9.3

Open the chart page →

31,404
codetranstest-opea1.0.01 of 5See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
opea/codetrans-ui:1.03ef121f34610
devalue@5.0.0
5.9.3

Open the chart page →

30,910
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry GHSA-mcm9-63f2-9j32.

Container imageDigestPackageFixed in
opea/docsum-ui:1.07f854e9bffaf
devalue@5.0.0
5.9.3

Open the chart page →

31,411

Container images carrying it

30 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/lissy93/web-check:latest7e2ef5261764
devalue@5.8.2
5.9.3
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
devalue@5.9.0
5.9.3
2
baserow/baserow:1.30.1df0c42eb67e8
devalue@2.0.1
5.9.3
1
baserow/web-frontend:2.4.00d91358ed205
devalue@5.9.2
5.9.3
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
devalue@2.0.1
5.9.3
1
litlyx/litlyx-dashboard:lateste64ff2d52385
devalue@5.5.0
5.9.3
1
ondrejsika/parking:latestb1fd497416c8
devalue@2.0.1
5.9.3
1
opea/codegen-ui:1.02bee4eb66f3e
devalue@4.3.3
5.9.3
1
opea/codetrans-ui:1.03ef121f34610
devalue@5.0.0
5.9.3
1
opea/docsum-ui:1.07f854e9bffaf
devalue@5.0.0
5.9.3
1
openmined/syft-frontend:0.9.5d11524a3854a
devalue@4.3.2
5.9.3
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
devalue@5.0.0
5.9.3
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
devalue@5.0.0
5.9.3
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
devalue@5.0.0
5.9.3
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
devalue@5.0.0
5.9.3
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
devalue@5.0.0
5.9.3
1
ghcr.io/appscode/platform-ui:2.5.0c27cafe398c2
devalue@5.7.1
5.9.3
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
devalue@5.6.4
5.9.3
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
devalue@4.3.2
5.9.3
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
devalue@2.0.1
5.9.3
1
ghcr.io/data-fair/metrics:0a8d40779eeae
devalue@2.0.1
5.9.3
1
ghcr.io/data-fair/notify:3c739b74dabb0
devalue@2.0.1
5.9.3
1
ghcr.io/data-fair/portals:18b621866ceb2
devalue@2.0.1
5.9.3
1
ghcr.io/data-fair/processings:15a9216989707
devalue@2.0.1
5.9.3
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
devalue@2.0.1
5.9.3
1
ghcr.io/elk-zone/elk:main046dfdb8550c
devalue@5.6.4
5.9.3
1
ghcr.io/elk-zone/elk:v1.0.1236faedcb68a
devalue@5.6.4
5.9.3
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
devalue@5.8.1
5.9.3
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
devalue@5.8.1
5.9.3
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
devalue@5.6.4
5.9.3
1

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.