StackRadar

GHSA-rpj2-4hq8-938g

High

Advisory

Published 19 Jun 2026In the index since 8 Sept 2026
Severity
High
worst across findings
CVSS
7.8
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
3
of 17,781 indexed, latest versions
Container images
4
deployed by those charts
Fix available
1 of 1
affected package

VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files

Carried by container images the latest versions of 3 of 17,781 indexed charts deploy, on 4 images.

Affected packageAffected versionsFixed inImages
vcrpypypi2.0.1, 4.1.1, 7.0.08.2.14
OSV records
GHSA-rpj2-4hq8-938g

Charts affected

3 by stars
ChartLatestAffected imagesRadar Score
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry GHSA-rpj2-4hq8-938g.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
vcrpy@2.0.1
8.2.1
codecov/self-hosted-worker:24.4.1837f546b479b
vcrpy@4.1.1
8.2.1

Open the chart page →

24,917
azure-pipelines-agentfermosit0.0.11 of 1See more

azure-pipelines-agent fermosit 0.0.1

1 of the 1 container images this version deploys carry GHSA-rpj2-4hq8-938g.

Container imageDigestPackageFixed in
jmferrer/azure-devops-agent:latest030f68ec6998
vcrpy@2.0.1
8.2.1

Open the chart page →

14,673
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-rpj2-4hq8-938g.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
vcrpy@7.0.0
8.2.1

Open the chart page →

7,436

Container images carrying it

4 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
checkmk/check-mk-community:2.5.0p6c11b422210c4
vcrpy@7.0.0
8.2.1
1
codecov/self-hosted-api:24.4.10475cb1c3136
vcrpy@2.0.1
8.2.1
1
codecov/self-hosted-worker:24.4.1837f546b479b
vcrpy@4.1.1
8.2.1
1
jmferrer/azure-devops-agent:latest030f68ec6998
vcrpy@2.0.1
8.2.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.