StackRadar

GHSA-wq5f-xc86-pv6w

High

Advisory

Published 6 Oct 2026In the index since 7 Oct 2026
Severity
High
worst across findings
CVSS
8.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
173
of 18,035 indexed, latest versions
Container images
173
deployed by those charts
Fix available
1 of 1
affected package

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Carried by container images the latest versions of 173 of 18,035 indexed charts deploy, on 173 images.

Affected packageAffected versionsFixed inImages
sharpnpm0.23.4, 0.27.2, 0.28.1, 0.29.0+18 more0.35.5173
OSV records
GHSA-wq5f-xc86-pv6w

Charts affected

173 by stars
ChartLatestAffected imagesRadar Score
rocketchatrocketchat-server7.0.21 of 12See more

rocketchat rocketchat-server 7.0.2

1 of the 12 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
rocketchat/ddp-streamer-service:8.6.1819771c4abe4
sharp@0.33.5
0.35.5

Open the chart page →

15,662
penpotpenpotOfficialVerified publisher1.11.31 of 5See more

penpot penpot 1.11.3

1 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
penpotapp/mcp:2.18.35e811e6eeb17
sharp@0.35.4
0.35.5

Open the chart page →

6,130
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
langgenius/dify-web:1.10.1-fix.1c306ac577912
sharp@0.34.4
0.35.5

Open the chart page →

82,241
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
langgenius/dify-web:1.16.187dd47e4e28f
sharp@0.35.3
0.35.5

Open the chart page →

72,711
lemmyananace-chartsVerified publisher0.6.151 of 5See more

lemmy ananace-charts 0.6.15

1 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
dessalines/lemmy-ui:0.19.20ee4c620d8e93
sharp@0.33.5
0.35.5

Open the chart page →

8,004
homarrhomarr-labsOfficialVerified publisher8.32.01 of 1See more

homarr homarr-labs 8.32.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v2.2.01b4ea544e267
sharp@0.35.4
0.35.5

Open the chart page →

380
openclawopenclaw-helmVerified publisher1.5.401 of 2See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.5.22dcfd14877740
sharp@0.34.5
0.35.5

Open the chart page →

6,594
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latest27602401178d
sharp@0.34.5
0.35.5

Open the chart page →

3,522
homepagem0nsterrr-homepageVerified publisher5.4.01 of 1See more

homepage m0nsterrr-homepage 5.4.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v2.4.0643bd0be730d
sharp@0.35.4
0.35.5

Open the chart page →

608
umamichristianhuthVerified publisher7.14.11 of 2See more

umami christianhuth 7.14.1

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
sharp@0.34.3
0.35.5

Open the chart page →

2,511
umamiwaldo-visionVerified publisher0.0.11 of 1See more

umami waldo-vision 0.0.1

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.5

Open the chart page →

1,341
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
sharp@0.30.3
0.35.5

Open the chart page →

5,622
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
sharp@0.34.5
0.35.5

Open the chart page →

11,754
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5

Open the chart page →

1,957
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
sharp@0.32.6
0.35.5

Open the chart page →

3,305
libredb-studiolibredb-studioOfficialVerified publisher0.1.781 of 1See more

libredb-studio libredb-studio 0.1.78

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/libredb/libredb-studio:0.18.0095a5ed5f7a1
sharp@0.35.4
0.35.5

Open the chart page →

1,447
cosmocosmo-platformOfficialVerified publisher0.21.01 of 10See more

cosmo cosmo-platform 0.21.0

1 of the 10 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.5

Open the chart page →

34,320
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
sharp@0.35.4
0.35.5

Open the chart page →

1,040
flyte-binaryflyte2.0.501 of 4See more

flyte-binary flyte 2.0.50

1 of the 4 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
sharp@0.35.3
0.35.5

Open the chart page →

4,946
flyte-coreflyte2.0.501 of 3See more

flyte-core flyte 2.0.50

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/unionai-oss/flyteconsole-v2:latestd06cbcbf85dc
sharp@0.35.3
0.35.5

Open the chart page →

756
browserless-chromesagikazarmarkVerified publisher0.0.51 of 1See more

browserless-chrome sagikazarmark 0.0.5

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
sharp@0.29.0
0.35.5

Open the chart page →

102,325
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
sharp@0.33.4
0.35.5

Open the chart page →

5,239
agentareaagentareaVerified publisher0.0.261 of 17See more

agentarea agentarea 0.0.26

1 of the 17 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:latest56360a626a00
sharp@0.35.4
0.35.5

Open the chart page →

16,620
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

196,205
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
sharp@0.27.2
0.35.5

Open the chart page →

196,185
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
sharp@0.34.5
0.35.5

Open the chart page →

2,474
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
sharp@0.35.4
0.35.5

Open the chart page →

2,074
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/data-fair/data-fair:3cc9498b64b5b
sharp@0.32.6
0.35.5
ghcr.io/data-fair/portals:18b621866ceb2
sharp@0.31.3
0.35.5

Open the chart page →

42,628
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
sharp@0.34.5
0.35.5

Open the chart page →

9,382
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
sharp@0.34.5
0.35.5

Open the chart page →

2,975
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
sharp@0.29.3
0.35.5

Open the chart page →

4,985
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
sharp@0.34.4
0.35.5

Open the chart page →

18,214
kikplatekikplateVerified publisher0.22.01 of 3See more

kikplate kikplate 0.22.0

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/kikplate/kikplate-web:main34bbb61e8e42
sharp@0.34.5
0.35.5

Open the chart page →

3,267
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
langgenius/dify-web:0.6.11a2a294743634
sharp@0.33.2
0.35.5

Open the chart page →

22,470
kube-ingress-dash-chartkube-ingress-dashVerified publisher0.3.11 of 1See more

kube-ingress-dash-chart kube-ingress-dash 0.3.1

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.5

Open the chart page →

1,602
bulwark-maill4gVerified publisher0.2.21 of 1See more

bulwark-mail l4g 0.2.2

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/bulwarkmail/webmail:1.6.0f0a266506fcf
sharp@0.34.5
0.35.5

Open the chart page →

807
chibisafel4gVerified publisher0.1.12 of 3See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
chibisafe/chibisafe:latest836467a50792
sharp@0.33.3
0.35.5
chibisafe/chibisafe-server:latest3da4fcbc1a18
sharp@0.33.2
0.35.5

Open the chart page →

5,761
lakilakiOfficialVerified publisher1.11.01 of 2See more

laki laki 1.11.0

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/laki-n/laki-ui:v1.6.0e51253617271
sharp@0.35.3
0.35.5

Open the chart page →

504
plane-enterprisemakeplaneOfficialVerified publisher3.10.33 of 13See more

plane-enterprise makeplane 3.10.3

3 of the 13 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
makeplane/live-commercial:v3.3.1d68fab8f6a3e
sharp@0.35.4
0.35.5
makeplane/silo-commercial:v3.3.1f0825c6b22d1
sharp@0.35.4
0.35.5
makeplane/space-commercial:v3.3.19360e65bf273
sharp@0.35.4
0.35.5

Open the chart page →

6,159
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
moreillon/food-manager:lateste8fd856e593d
sharp@0.29.3
0.35.5

Open the chart page →

15,437
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.31 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

1 of the 34 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
sharp@0.35.4
0.35.5

Open the chart page →

24,711
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
sharp@0.34.5
0.35.5

Open the chart page →

8,397
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
prowlercloud/prowler-ui:5.31.179ee83c8e702
sharp@0.33.5
0.35.5

Open the chart page →

9,838
jellyseerrrtomik-helm-chartsVerified publisher0.0.11 of 1See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
sharp@0.33.4
0.35.5

Open the chart page →

3,411
immichsecustorVerified publisher2.0.71 of 1See more

immich secustor 2.0.7

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.2.4d317916b2809
sharp@0.35.3
0.35.5

Open the chart page →

3,353
karakeepself-hosters-by-nightVerified publisher2.5.11 of 1See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
sharp@0.34.3
0.35.5

Open the chart page →

6,090
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
dserio83/velero-ui:0.3.1b4e1ec6664d3
sharp@0.33.5
0.35.5

Open the chart page →

13,145
speckle-serverspeckleVerified publisher2.26.31 of 4See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
speckle/speckle-server:2.26.379f14a2bf931
sharp@0.34.4
0.35.5

Open the chart page →

11,864
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
supabase/studio:2026.08.03-sha-022b374606aca9fdaa7
sharp@0.34.5
0.35.5

Open the chart page →

21,571
u-storeunifieVerified publisher1.2.01 of 1See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry GHSA-wq5f-xc86-pv6w.

Container imageDigestPackageFixed in
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.5

Open the chart page →

16,614

Container images carrying it

173 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
sharp@0.34.5
0.35.5
1
ghcr.io/quenchworks/images/homepage5057b6862523
sharp@0.35.4
0.35.5
1
ghcr.io/radar-base/radar-self-enrolment-ui:0.1.0b9a7cd3cc099
sharp@0.34.4
0.35.5
1
ghcr.io/rybbit-io/rybbit-client:latest9a3bbb2e837a
sharp@0.34.5
0.35.5
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
sharp@0.33.4
0.35.5
1
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
sharp@0.34.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
sharp@0.33.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
sharp@0.33.5
0.35.5
1
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
sharp@0.33.5
0.35.5
1
ghcr.io/umami-software/umami:3.0.328f263fe06f7
sharp@0.34.3
0.35.5
1
ghcr.io/umami-software/umami:postgresql-v1.39.560fa8875aff8
sharp@0.30.7
0.35.5
1
ghcr.io/umami-software/umami:postgresql-v2.20.173ca19b41745
sharp@0.34.3
0.35.5
1
ghcr.io/umami-software/umami:3.4.085909afc45bd
sharp@0.35.4
0.35.5
1
ghcr.io/umami-software/umami:3.1.0e3f80c0625aa
sharp@0.34.5
0.35.5
1
ghcr.io/wachd/wachd:0.4.1805b05c56da94
sharp@0.34.5
0.35.5
1
ghcr.io/waldo-vision/web:v0.3.65bbc7647df07
sharp@0.32.0
0.35.5
1
ghcr.io/wasilak/kube-ingress-dash:0.3.1ff55992f905c
sharp@0.34.5
0.35.5
1
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
sharp@0.33.5
0.35.5
1
ghcr.io/xmv-solutions-gmbh/strapi:latest978cda40de67
sharp@0.33.5
0.35.5
1
public.ecr.aws/flanksource/incident-manager-ui:v1.4.317fea799d4fb2f
sharp@0.34.5
0.35.5
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
sharp@0.33.5
0.35.5
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
sharp@0.28.1
0.35.5
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
sharp@0.34.5
0.35.5
1

syft 1.42.1 · advisories as of 7 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.