StackRadarChart IndexLive demo

GHSA-q2c6-c6pm-g3gh

High

Advisory

Published 4 Sept 2020In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 18; of 17,781 indexed, latest versions
Container images: 15; deployed by those charts
Fix available: 1 of 1; affected package

Arbitrary Code Execution in handlebars

Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 15 images.

Affected package	Affected versions	Fixed in	Images
handlebarsnpm	1.0.0, 1.39.1-prel, 2.0.0, 4.0.6+6 more	3.0.8, 4.5.3	15

OSV records: GHSA-q2c6-c6pm-g3gh

Charts affected

18 by stars

Chart

Latest

Affected images

Radar Score

code-serverdeploy-code-server

1 of 2 See more

code-server deploy-code-server 1.0.3

1 of the 2 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
codercom/code-server :3.10.2	47605610ad8d	handlebars@1.0.0	3.0.8

Open the chart page →

4,577

netris-controllernetrisai

1 of 14 See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	handlebars@4.1.2	4.5.3

Open the chart page →

30,326

code-serveralekc

1 of 1 See more

code-server alekc 0.1.1

1 of the 1 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
linuxserver/code-server :4.10.1	a5e43a05ae79	handlebars@1.0.0	3.0.8

Open the chart page →

8,212

kongakonga

1 of 1 See more

konga konga 1.1.0

1 of the 1 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	handlebars@4.0.10	4.5.3

Open the chart page →

5,209

portraitportrait

1 of 8 See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
codercom/code-server :4.11.0-debian	1e2cc688008e	handlebars@1.0.0	3.0.8

Open the chart page →

31,844

openapiassist-iot-open-api-management

1 of 6 See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	handlebars@4.0.10	4.5.3

Open the chart page →

18,277

registry-uibryanalves

1 of 1 See more

registry-ui bryanalves 0.2.0

1 of the 1 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
konradkleine/docker-registry-frontend :v2	181aad54ee64	handlebars@2.0.0	3.0.8

Open the chart page →

4,069

daskcloudnativeapp

1 of 2 See more

dask cloudnativeapp 2.2.1

1 of the 2 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
daskdev/dask-notebook :1.1.0	052630f5ca04	handlebars@4.0.12	4.5.3

Open the chart page →

29,901

dev-code-servercosmo

1 of 2 See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	handlebars@1.0.0	3.0.8

Open the chart page →

14,559

kongacreate-databases

1 of 1 See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
pantsel/konga :latest	c8172b75607d	handlebars@4.0.10	4.5.3

Open the chart page →

5,209

Governify-Bluejaygovernify

1 of 12 See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
governify/assets-manager :v1.4.1	2987672448c7	handlebars@1.39.1-prel	3.0.8

Open the chart page →

22,512

Governify-Falcongovernify

1 of 10 See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
governify/assets-manager :v1.4.1	2987672448c7	handlebars@1.39.1-prel	3.0.8

Open the chart page →

24,319

ibm-app-navigatoribm-charts

1 of 5 See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
ibmcom/app-nav-ui :1.0.1	e2a86997b36b	handlebars@4.1.2	4.5.3

Open the chart page →

32,915

ibm-microclimateibm-charts

1 of 8 See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
ibmcom/microclimate-portal :latest	ed5505e5c7ec	handlebars@4.0.11	4.5.3

Open the chart page →

57,669

monocularjenkins-x

1 of 4 See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
migmartri/prerender :latest	486aacfd5aa9	handlebars@4.0.6	4.5.3

Open the chart page →

4,614

opendistro-eslsst-sqre

1 of 3 See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.4.0	5126e2e79a1f	handlebars@4.3.5	4.5.3

Open the chart page →

7,929

monocularmonocular

2 of 5 See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
migmartri/prerender :latest	486aacfd5aa9	handlebars@4.0.6	4.5.3
quay.io/helmpack/monocular-ui :v1.10.0	86b71e90319f	handlebars@4.0.10	4.5.3

Open the chart page →

7,048

hive-selfservice-ui-nodeory

1 of 1 See more

hive-selfservice-ui-node ory 0.1.0

1 of the 1 container images this version deploys carry GHSA-q2c6-c6pm-g3gh.

Container image	Digest	Package	Fixed in
oryd/hive-selfservice-ui-node :v0.0.4	26347ef0a2de	handlebars@4.4.5	4.5.3

Open the chart page →

1,986

Container images carrying it

15 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
pantsel/konga :latest	c8172b75607d	handlebars@4.0.10	4.5.3	3
governify/assets-manager :v1.4.1	2987672448c7	handlebars@1.39.1-prel	3.0.8	2
migmartri/prerender :latest	486aacfd5aa9	handlebars@4.0.6	4.5.3	2
amazon/opendistro-for-elasticsearch-kibana :1.4.0	5126e2e79a1f	handlebars@4.3.5	4.5.3	1
codercom/code-server :4.11.0-debian	1e2cc688008e	handlebars@1.0.0	3.0.8	1
codercom/code-server :3.10.2	47605610ad8d	handlebars@1.0.0	3.0.8	1
daskdev/dask-notebook :1.1.0	052630f5ca04	handlebars@4.0.12	4.5.3	1
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	handlebars@4.1.2	4.5.3	1
ibmcom/app-nav-ui :1.0.1	e2a86997b36b	handlebars@4.1.2	4.5.3	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	handlebars@4.0.11	4.5.3	1
konradkleine/docker-registry-frontend :v2	181aad54ee64	handlebars@2.0.0	3.0.8	1
linuxserver/code-server :4.10.1	a5e43a05ae79	handlebars@1.0.0	3.0.8	1
oryd/hive-selfservice-ui-node :v0.0.4	26347ef0a2de	handlebars@4.4.5	4.5.3	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	handlebars@1.0.0	3.0.8	1
quay.io/helmpack/monocular-ui :v1.10.0	86b71e90319f	handlebars@4.0.10	4.5.3	1