StackRadar

GHSA-rgj7-g3m4-5g8c

High

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
151
of 17,781 indexed, latest versions
Container images
150
deployed by those charts
Fix available
1 of 1
affected package

sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

Carried by container images the latest versions of 151 of 17,781 indexed charts deploy, on 150 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.27.2, 0.28.1, 0.29.0, 0.29.2+19 more0.35.4150
OSV records
GHSA-rgj7-g3m4-5g8c

Charts affected

151 by stars
ChartLatestAffected imagesRadar Score
websitewaldo-visionVerified publisher0.33.01 of 2See more

website waldo-vision 0.33.0

1 of the 2 container images this version deploys carry GHSA-rgj7-g3m4-5g8c.

Container imageDigestPackageFixed in
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4

Open the chart page →

3,474

Container images carrying it

150 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/clastix/kamaji-console:v0.2.129ecf8d4fa65
sharp@0.33.5
0.35.4
1
ghcr.io/colanode/server:latest7006cac874fd
sharp@0.34.5
0.35.4
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
sharp@0.33.5
0.35.4
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.4
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.4
1
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.4
1
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
sharp@0.34.5
0.35.4
1
ghcr.io/gethomepage/homepage:v2.3.0f82027665453
sharp@0.35.3
0.35.4
1
ghcr.io/glassflow/glassflow-etl-fe:v3.2.05eaad43bd6c5
sharp@0.34.5
0.35.4
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
sharp@0.34.5
0.35.4
1
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
sharp@0.35.3
0.35.4
1
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
sharp@0.35.3
0.35.4
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
sharp@0.35.3
0.35.4
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
sharp@0.34.5
0.35.4
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
sharp@0.34.4
0.35.4
1
ghcr.io/kadajett/podscope:0.2.3eeedf17112d7
sharp@0.34.5
0.35.4
1
ghcr.io/kagent-dev/kagent/ui:0.10.12c4de55d3ffe
sharp@0.35.3
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
sharp@0.34.5
0.35.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
sharp@0.33.3
0.35.4
1
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.4
1
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.4
1
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
sharp@0.34.5
0.35.4
1
ghcr.io/microboxlabs/miot-docs:lateste09d92c61f43
sharp@0.35.3
0.35.4
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.4
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
sharp@0.34.5
0.35.4
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
sharp@0.33.4
0.35.4
1
ghcr.io/open-telemetry/demo:3.0.0-frontend9505e349e140
sharp@0.34.5
0.35.4
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
sharp@0.34.5
0.35.4
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.4
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.4
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
sharp@0.33.4
0.35.4
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
sharp@0.35.3
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.4
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.4
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
sharp@0.34.3
0.35.4
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.4
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
sharp@0.34.3
0.35.4
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
sharp@0.34.5
0.35.4
1
ghcr.io/umami-software/umami:3.3.1fa32d116cf20
sharp@0.35.3
0.35.4
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.4
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.4
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.4
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.4
1
ghcr.io/xmv-solutions-gmbh/strapi:latesta288b4571142
sharp@0.33.5
0.35.4
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
sharp@0.34.5
0.35.4
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sharp@0.28.1
0.35.4
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
sharp@0.34.5
0.35.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.