StackRadar

GHSA-pjjw-68hj-v9mw

Low

Advisory

Published 10 Apr 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
19
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 1
affected package

uv vulnerable to arbitrary file deletion through RECORD entries

Carried by container images the latest versions of 19 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
uvpypi0.4.1, 0.4.29, 0.5.27, 0.6.1+12 more0.11.622
OSV records
GHSA-pjjw-68hj-v9mw

Charts affected

19 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.6

Open the chart page →

19,391
difydify-helmVerified publisher0.38.03 of 11See more

dify dify-helm 0.38.0

3 of the 11 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
uv@0.8.9
0.11.6
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
uv@0.8.9
0.11.6
langgenius/dify-api:1.16.1dcefa5f7c47c
uv@0.8.9
0.11.6

Open the chart page →

22,002
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.6

Open the chart page →

16,251
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.6

Open the chart page →

4,634
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.6

Open the chart page →

7,201
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.6
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.6

Open the chart page →

16,449
esphomealekcVerified publisher2.8.11 of 1See more

esphome alekc 2.8.1

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
esphome/esphome:2026.8.285abea33854b
uv@0.10.1
0.11.6

Open the chart page →

3,112
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.6

Open the chart page →

26,996
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.6

Open the chart page →

15,371
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.6

Open the chart page →

20,900
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
uv@0.7.20
0.11.6

Open the chart page →

58,897
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
uv@0.10.1
0.11.6

Open the chart page →

3,121
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest000c5ee5ee96
uv@0.10.1
0.11.6

Open the chart page →

3,112
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.6

Open the chart page →

4,647
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
uv@0.10.11
0.11.6

Open the chart page →

10,849
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.6

Open the chart page →

5,040
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.6

Open the chart page →

5,823
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.6

Open the chart page →

4,749
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry GHSA-pjjw-68hj-v9mw.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.6

Open the chart page →

21,211

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/airflow:2.10.2-python3.9ce90bdc3d2af
uv@0.4.1
0.11.6
1
bmeares/meerschaum:2.8.48e9c5bacaa82
uv@0.5.27
0.11.6
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
uv@0.10.11
0.11.6
1
esphome/esphome:2026.7.44866347cb5b4
uv@0.10.1
0.11.6
1
esphome/esphome:2026.8.285abea33854b
uv@0.10.1
0.11.6
1
grafana/oncall:v1.16.5499851658393
uv@0.8.13
0.11.6
1
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
uv@0.8.9
0.11.6
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
uv@0.8.9
0.11.6
1
langgenius/dify-api:1.16.1dcefa5f7c47c
uv@0.8.9
0.11.6
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
uv@0.9.17
0.11.6
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
uv@0.7.20
0.11.6
1
sysnet4admin/colosseum-rwd:log74ded2d92f07
uv@0.6.14
0.11.6
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
uv@0.6.3
0.11.6
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
uv@0.4.29
0.11.6
1
ghcr.io/esphome/esphome:latest000c5ee5ee96
uv@0.10.1
0.11.6
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
uv@0.10.1
0.11.6
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
uv@0.9.28
0.11.6
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
uv@0.9.28
0.11.6
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
uv@0.6.1
0.11.6
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
uv@0.9.6
0.11.6
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
uv@0.10.6
0.11.6
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
uv@0.9.26
0.11.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.