StackRadar

GHSA-vx52-2968-3vc6

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,781 indexed, latest versions
Container images
29
deployed by those charts
Fix available
1 of 1
affected package

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 29 images.

Affected packageAffected versionsFixed inImages
pnpmnpm10.8.0, 10.12.1, 10.15.1, 10.17.0+13 more10.34.5, 11.11.029
OSV records
GHSA-vx52-2968-3vc6

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
penpotpenpotOfficialVerified publisher1.9.02 of 4See more

penpot penpot 1.9.0

2 of the 4 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
penpotapp/exporter:2.17.272a8061e8806
pnpm@11.9.0
11.11.0
penpotapp/mcp:2.17.284f3f07ead11
pnpm@11.9.0
11.11.0

Open the chart page →

4,314
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
pnpm@10.22.0
10.34.5

Open the chart page →

19,391
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
pnpm@11.9.0
11.11.0

Open the chart page →

22,002
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
pnpm@11.2.2
11.11.0

Open the chart page →

5,660
umamichristianhuthVerified publisher7.13.01 of 2See more

umami christianhuth 7.13.0

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
pnpm@10.24.0
10.34.5

Open the chart page →

2,367
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
pnpm@11.5.3
11.11.0

Open the chart page →

1,304
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
pnpm@11.2.2
11.11.0

Open the chart page →

5,218
litlyxlitlyx0.2.02 of 5See more

litlyx litlyx 0.2.0

2 of the 5 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
litlyx/litlyx-consumer:latest02225e77d316
pnpm@10.23.0
10.34.5
litlyx/litlyx-producer:latest10407f36613f
pnpm@10.23.0
10.34.5

Open the chart page →

7,874
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
pnpm@10.15.1
10.34.5

Open the chart page →

7,035
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
pnpm@10.33.0
10.34.5

Open the chart page →

5,482
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad2 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

2 of the 6 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
pnpm@10.17.0
10.34.5
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
pnpm@10.17.0
10.34.5

Open the chart page →

18,293
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pnpm@10.8.0
10.34.5

Open the chart page →

14,559
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
pnpm@10.33.0
10.34.5

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
pnpm@10.33.0
10.34.5

Open the chart page →

3,092
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
pnpm@11.1.2
11.11.0

Open the chart page →

2,756
umamikubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

umami kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
pnpm@10.33.0
10.34.5

Open the chart page →

2,596
logtidelogtideVerified publisher2.1.142 of 4See more

logtide logtide 2.1.14

2 of the 4 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
pnpm@10.34.4
10.34.5
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
pnpm@10.34.4
10.34.5

Open the chart page →

2,774
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
pnpm@10.12.1
10.34.5

Open the chart page →

24,400
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.0.328f263fe06f7
pnpm@10.25.0
10.34.5

Open the chart page →

4,016
ixyneoskop2.1.11 of 1See more

ixy neoskop 2.1.1

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
neoskop/ixy:2.1.125152b474f54
pnpm@11.10.0
11.11.0

Open the chart page →

1,166
nostreamnostream0.1.01 of 1See more

nostream nostream 0.1.0

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/cameri/nostream:main8726533b9e69
pnpm@10.33.0
10.34.5

Open the chart page →

595
firecrawlobeoneVerified publisher3.0.11 of 5See more

firecrawl obeone 3.0.1

1 of the 5 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
ghcr.io/firecrawl/firecrawl:2.11.33092ee28c20a0d
pnpm@11.4.0
11.11.0

Open the chart page →

9,995
etherpadredhat-cop0.0.81 of 1See more

etherpad redhat-cop 0.0.8

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
etherpad/etherpad:latest6020e7b57f4b
pnpm@11.9.0
11.11.0

Open the chart page →

895
etherpadschoenwald0.3.01 of 1See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
etherpad/etherpad:2.7.2b723fe5f2594
pnpm@10.33.0
10.34.5

Open the chart page →

2,133
tensorzerotensorzero2026.6.01 of 2See more

tensorzero tensorzero 2026.6.0

1 of the 2 container images this version deploys carry GHSA-vx52-2968-3vc6.

Container imageDigestPackageFixed in
tensorzero/ui:2026.6.0f2563d54724e
pnpm@11.5.1
11.11.0

Open the chart page →

3,972

Container images carrying it

29 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
aaronshaf/dynamodb-admin:latestac41724cd997
pnpm@11.5.3
11.11.0
1
chocobozzz/peertube:v8.1.5052712130691
pnpm@10.15.1
10.34.5
1
etherpad/etherpad:latest6020e7b57f4b
pnpm@11.9.0
11.11.0
1
etherpad/etherpad:2.7.2b723fe5f2594
pnpm@10.33.0
10.34.5
1
langgenius/dify-agent-local-sandbox:1.16.1bf8027ddccf3
pnpm@11.9.0
11.11.0
1
langgenius/dify-web:1.10.1-fix.1c306ac577912
pnpm@10.22.0
10.34.5
1
library/ghost:6.37.01ef2e532ca4d
pnpm@10.33.0
10.34.5
1
library/ghost:6.41.129773d6be407
pnpm@10.33.0
10.34.5
1
library/ghost:6.39.0-alpine77196da4b0df
pnpm@11.1.2
11.11.0
1
litlyx/litlyx-consumer:latest02225e77d316
pnpm@10.23.0
10.34.5
1
litlyx/litlyx-producer:latest10407f36613f
pnpm@10.23.0
10.34.5
1
neoskop/ixy:2.1.125152b474f54
pnpm@11.10.0
11.11.0
1
penpotapp/exporter:2.17.272a8061e8806
pnpm@11.9.0
11.11.0
1
penpotapp/mcp:2.17.284f3f07ead11
pnpm@11.9.0
11.11.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
pnpm@10.33.0
10.34.5
1
tensorzero/ui:2026.6.0f2563d54724e
pnpm@11.5.1
11.11.0
1
ghcr.io/absmach/magistrala/ui-smq:latestea7e7f0e293e
pnpm@10.12.1
10.34.5
1
ghcr.io/cameri/nostream:main8726533b9e69
pnpm@10.33.0
10.34.5
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
pnpm@10.8.0
10.34.5
1
ghcr.io/firecrawl/firecrawl:2.11.33092ee28c20a0d
pnpm@11.4.0
11.11.0
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
pnpm@10.17.0
10.34.5
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
pnpm@10.17.0
10.34.5
1
ghcr.io/logtide-dev/logtide-backend:1.0.265463e02f887
pnpm@10.34.4
10.34.5
1
ghcr.io/logtide-dev/logtide-frontend:1.0.22a7da1451f86
pnpm@10.34.4
10.34.5
1
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
pnpm@11.2.2
11.11.0
1
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
pnpm@11.2.2
11.11.0
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
pnpm@10.25.0
10.34.5
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
pnpm@10.24.0
10.34.5
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
pnpm@10.33.0
10.34.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.