StackRadarChart IndexLive demo

GHSA-wwv5-g3v4-889x

Low

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Low; worst across findings
CVSS: 2.3; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 22; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: 1 of 1; affected package

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Carried by container images the latest versions of 22 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
tornadopypi	6.5.5, 6.5.6, 6.5.7	6.5.8	21

OSV records: GHSA-wwv5-g3v4-889x

Charts affected

22 by stars

Chart

Latest

Affected images

Radar Score

litellm-helmlitellm

1 of 2 See more

litellm-helm litellm 1.100.1

1 of the 2 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :1.100.1	a3715fa7ad83	tornado@6.5.7	6.5.8

Open the chart page →

5,003

baserowbaserow-chart

1 of 6 See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
baserow/backend :2.3.3	7c00549b3a6f	tornado@6.5.7	6.5.8

Open the chart page →

17,263

matrixzekker6

1 of 4 See more

matrix zekker6 3.30.0

1 of the 4 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
matrixdotorg/synapse :v1.160.0	78de1d10bef0	tornado@6.5.7	6.5.8

Open the chart page →

5,557

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	tornado@6.5.7	6.5.8

Open the chart page →

4,477

wgerwger

1 of 8 See more

8,491

hermes-agentankra-charts

1 of 1 See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	tornado@6.5.7	6.5.8

Open the chart page →

5,880

jupyterhub-outpostjupyter-jsc

1 of 1 See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
jupyterjsc/jupyterhub-outpost :2.3.1	aea53b13f235	tornado@6.5.5	6.5.8

Open the chart page →

1,678

palworldpalworld-server-chart

1 of 1 See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	tornado@6.5.5	6.5.8

Open the chart page →

3,681

litellmalareira

1 of 1 See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :main-stable	c8756e7b9a61	tornado@6.5.7	6.5.8

Open the chart page →

83

galaxycloudve

1 of 3 See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	tornado@6.5.5	6.5.8

Open the chart page →

4,601

codehubcodehub

1 of 5 See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
jupyterhub/jupyterhub :5.4.6	3974ba945e65	tornado@6.5.6	6.5.8

Open the chart page →

13,220

datagrokdatagrok

1 of 7 See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
datagrok/grok_spawner :latest	8c2d48c1545c	tornado@6.5.7	6.5.8

Open the chart page →

2,328

helixhelix

1 of 2 See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	tornado@6.5.5	6.5.8

Open the chart page →

5,568

jupyterhubhelmforge

1 of 3 See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	tornado@6.5.5	6.5.8

Open the chart page →

5,341

intelowlintelowl-helm

6.6.1-01-06-2026

1 of 5 See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	tornado@6.5.5	6.5.8

Open the chart page →

17,852

esphomejeffresc

1 of 1 See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
ghcr.io/esphome/esphome :2026.4.0	78a82d810709	tornado@6.5.5	6.5.8

Open the chart page →

5,040

palworld-serverk8s-charts

1 of 1 See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	tornado@6.5.5	6.5.8

Open the chart page →

3,460

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	473fdffe4e67	tornado@6.5.7	6.5.8

Open the chart page →

6,338

safe-stacksafe-global

1 of 9 See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
safeglobal/safe-transaction-service :latest	80db836cc5d5	tornado@6.5.7	6.5.8

Open the chart page →

19,560

safe-transaction-servicesafe-global

1 of 6 See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
safeglobal/safe-transaction-service :latest	80db836cc5d5	tornado@6.5.7	6.5.8

Open the chart page →

16,620

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	tornado@6.5.5	6.5.8

Open the chart page →

5,201

backendsignalen

1 of 4 See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry GHSA-wwv5-g3v4-889x.

Container image	Digest	Package	Fixed in
signalen/backend :2.50.14	760256000738	tornado@6.5.7	6.5.8

Open the chart page →

11,636

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
safeglobal/safe-transaction-service :latest	80db836cc5d5	tornado@6.5.7	6.5.8	2
baserow/backend :2.3.3	7c00549b3a6f	tornado@6.5.7	6.5.8	1
datagrok/grok_spawner :latest	8c2d48c1545c	tornado@6.5.7	6.5.8	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	tornado@6.5.5	6.5.8	1
jupyterhub/jupyterhub :5.4.6	3974ba945e65	tornado@6.5.6	6.5.8	1
jupyterjsc/jupyterhub-outpost :2.3.1	aea53b13f235	tornado@6.5.5	6.5.8	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	tornado@6.5.5	6.5.8	1
matrixdotorg/synapse :v1.160.0	78de1d10bef0	tornado@6.5.7	6.5.8	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	tornado@6.5.7	6.5.8	1
onyxdotapp/onyx-backend :latest	473fdffe4e67	tornado@6.5.7	6.5.8	1
signalen/backend :2.50.14	760256000738	tornado@6.5.7	6.5.8	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	tornado@6.5.5	6.5.8	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	tornado@6.5.5	6.5.8	1
wger/server :2.6	997ead43aabd	tornado@6.5.7	6.5.8	1
ghcr.io/berriai/litellm :1.100.1	a3715fa7ad83	tornado@6.5.7	6.5.8	1
ghcr.io/berriai/litellm :main-stable	c8756e7b9a61	tornado@6.5.7	6.5.8	1
ghcr.io/esphome/esphome :2026.4.0	78a82d810709	tornado@6.5.5	6.5.8	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	tornado@6.5.7	6.5.8	1
quay.io/galaxyproject/galaxy-min :26.1.1	2c324c9789f5	tornado@6.5.5	6.5.8	1
quay.io/jupyterhub/k8s-hub :4.3.5	113e372cf71b	tornado@6.5.5	6.5.8	1
quay.io/jupyterhub/k8s-hub :4.3.4	92f883d09270	tornado@6.5.5	6.5.8	1