GHSA-p498-v437-472g

Medium

Advisory

Published 2 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.7; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 20; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 1 of 1; affected package

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Carried by container images the latest versions of 20 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
@humanfs/nodenpm	0.16.6, 0.16.7	0.16.8	20

OSV records: GHSA-p498-v437-472g

Charts affected

20 by stars

Chart

Latest

Affected images

Radar Score

pretixtechwolf12

2026.7.0

1 of 3 See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
pretix/standalone :2026.7.0	5df3b7aa852e	@humanfs/node@0.16.7	0.16.8

Open the chart page →

9,770

enbuildenbuild

0.0.50

2 of 6 See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	@humanfs/node@0.16.7	0.16.8
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	@humanfs/node@0.16.7	0.16.8

Open the chart page →

31,510

ethereumjsethereum-helm-charts

0.1.2

1 of 2 See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
ethpandaops/ethereumjs :master	fb84b718500f	@humanfs/node@0.16.7	0.16.8

Open the chart page →

1,442

stornxstornx

1.1.1

1 of 9 See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
alazidis/stornx :1.1.1	602d4f7f090c	@humanfs/node@0.16.6	0.16.8

Open the chart page →

11,574

colosseumbook-k8sinfra-v2

1.0.18

2 of 5 See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
sysnet4admin/colosseum-cms :log	e74b43c7f492	@humanfs/node@0.16.6	0.16.8
sysnet4admin/colosseum-prm :log	5802bfcd7fed	@humanfs/node@0.16.6	0.16.8

Open the chart page →

26,996

desishowbiz-frontenddesishowbiz

1.0.0

1 of 1 See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
rahulbhiwagade122/desishowbiz :latest	08490b70998c	@humanfs/node@0.16.6	0.16.8

Open the chart page →

2,529

dumpstoredumpstore

0.1.1

1 of 2 See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	@humanfs/node@0.16.6	0.16.8

Open the chart page →

4,251

automatischhelmforge

1.3.7

1 of 4 See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
automatischio/automatisch :0.15.0	3bace7a12d5f	@humanfs/node@0.16.6	0.16.8

Open the chart page →

5,769

zwave-js-uik8sonlab

0.7.12

1 of 1 See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
zwavejs/zwave-js-ui :11.22.3	14d018bb689e	@humanfs/node@0.16.7	0.16.8

Open the chart page →

973

pangolinkrzwiatrzyk

0.11.0

1 of 1 See more

pangolin krzwiatrzyk 0.11.0

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
fosrl/pangolin :1.13.0	c32ad797ab96	@humanfs/node@0.16.7	0.16.8

Open the chart page →

3,441

bofmojaloop

5.1.6

1 of 1 See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@humanfs/node@0.16.7	0.16.8

Open the chart page →

2,457

finance-portalmojaloop

5.1.4

2 of 11 See more

finance-portal mojaloop 5.1.4

2 of the 11 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	@humanfs/node@0.16.6	0.16.8
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	@humanfs/node@0.16.6	0.16.8

Open the chart page →

14,809

reporting-events-processor-svcmojaloop

3.5.3

1 of 1 See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	@humanfs/node@0.16.6	0.16.8

Open the chart page →

2,631

reporting-hub-bop-experience-api-svcmojaloop

1.0.3

1 of 1 See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	@humanfs/node@0.16.6	0.16.8

Open the chart page →

2,318

security-role-perm-operator-svcmojaloop

3.0.0

1 of 1 See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@humanfs/node@0.16.7	0.16.8

Open the chart page →

2,457

nexus-tasksnexus-tasks

2.0.0

1 of 5 See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	@humanfs/node@0.16.7	0.16.8

Open the chart page →

3,798

helm-redchefredchef

0.1.0

1 of 3 See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
sharanalwar/redchef-frontend :latest	5e82950b16b7	@humanfs/node@0.16.6	0.16.8

Open the chart page →

4,763

retromretsamedoc

2026.2.5

1 of 1 See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	@humanfs/node@0.16.6	0.16.8

Open the chart page →

7,084

retail-store-sample-checkout-chartstacksimplify

1.0.0

1 of 1 See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	@humanfs/node@0.16.7	0.16.8

Open the chart page →

1,313

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-p498-v437-472g.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	@humanfs/node@0.16.7	0.16.8

Open the chart page →

4,305

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	@humanfs/node@0.16.6	0.16.8	2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	@humanfs/node@0.16.6	0.16.8	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	@humanfs/node@0.16.7	0.16.8	2
alazidis/stornx :1.1.1	602d4f7f090c	@humanfs/node@0.16.6	0.16.8	1
automatischio/automatisch :0.15.0	3bace7a12d5f	@humanfs/node@0.16.6	0.16.8	1
ethpandaops/ethereumjs :master	fb84b718500f	@humanfs/node@0.16.7	0.16.8	1
fosrl/pangolin :1.13.0	c32ad797ab96	@humanfs/node@0.16.7	0.16.8	1
pretix/standalone :2026.7.0	5df3b7aa852e	@humanfs/node@0.16.7	0.16.8	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	@humanfs/node@0.16.6	0.16.8	1
sharanalwar/redchef-frontend :latest	5e82950b16b7	@humanfs/node@0.16.6	0.16.8	1
sysnet4admin/colosseum-cms :log	e74b43c7f492	@humanfs/node@0.16.6	0.16.8	1
sysnet4admin/colosseum-prm :log	5802bfcd7fed	@humanfs/node@0.16.6	0.16.8	1
zwavejs/zwave-js-ui :11.22.3	14d018bb689e	@humanfs/node@0.16.7	0.16.8	1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	@humanfs/node@0.16.7	0.16.8	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	@humanfs/node@0.16.7	0.16.8	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	@humanfs/node@0.16.6	0.16.8	1
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	@humanfs/node@0.16.6	0.16.8	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	@humanfs/node@0.16.7	0.16.8	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	@humanfs/node@0.16.7	0.16.8	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user :1.0.31	d8a9cd4e1ae3	@humanfs/node@0.16.7	0.16.8	1