StackRadar

GHSA-x3cc-x39p-42qx

Medium

Advisory

Published 13 Jun 2023In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.099
95th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
24
deployed by those charts
Fix available
1 of 1
affected package

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 24 images.

Affected packageAffected versionsFixed inImages
fast-xml-parsernpm3.19.0, 3.21.1, 4.0.114.1.224
OSV records
GHSA-x3cc-x39p-42qx
Also known as
CVE-2021-26920, CVE-2023-26920, GHSA-793h-6f7r-6qvm

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
mongo-expresscowboysysopVerified publisher7.0.01 of 1See more

mongo-express cowboysysop 7.0.0

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
library/mongo-express:1.0.21b23d7976f02
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

1,210
misskeyalytiVerified publisher1.0.01 of 1See more

misskey alyti 1.0.0

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
misskey/misskey:12.110.1e08b7c478093
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

5,251
n8none-acre-fundVerified publisher0.1.521 of 3See more

n8n one-acre-fund 0.1.52

1 of the 3 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
n8nio/n8n:0.212.0a9195bc499a3
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

7,776
joplin-serverdjjudas21Verified publisher5.5.81 of 1See more

joplin-server djjudas21 5.5.8

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
joplin/server:2.14.2-betab87564ef34e9
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

3,925
ghostgeek-cookbookVerified publisher2.2.01 of 1See more

ghost geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
library/ghost:4.37.0767230c0f263
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

4,260
open-api-discoveryopen-api-discoveryVerified publisher0.1.11 of 1See more

open-api-discovery open-api-discovery 0.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
lukasreining/open-api-schema-collector:0.1.050e021c42e33
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

2,473
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

523
mx-apibicarus-labs0.1.01 of 4See more

mx-api bicarus-labs 0.1.0

1 of the 4 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

4,455
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

5,488
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

3,769
blobscanethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
ethpandaops/blobscan:latest7a9ab6370657
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

1,329
blobscan-indexerethereum-helm-chartsVerified publisher0.1.11 of 1See more

blobscan-indexer ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
ethpandaops/blobscan-indexer:latestc58eb9ffe446
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

2,114
shinobigeek-cookbookVerified publisher1.2.21 of 1See more

shinobi geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
shinobisystems/shinobi:dev3ca746937856
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

4,591
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

9,019
k10appk10app0.2.11 of 11See more

k10app k10app 0.2.1

1 of the 11 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
ghcr.io/k10app/catalog:latest639c980be0f1
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

10,546
shinobik8s-home-lab-repo2.1.11 of 1See more

shinobi k8s-home-lab-repo 2.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
shinobisystems/shinobi:latestc2f5ce2e1067
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

4,667
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

5,410
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
library/mongo-express:latest1b23d7976f02
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

5,179
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

7,413
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
library/mongo-express:1.0.2-20-alpine3.191aae00775251
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

2,309
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

3,118
k8soketisoketi1.0.11 of 1See more

k8soketi soketi 1.0.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
fast-xml-parser@4.0.11
4.1.2

Open the chart page →

2,267
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
fast-xml-parser@3.19.0
4.1.2

Open the chart page →

25,394
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

5,535
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

3,118
workadventureworkadventure1.1.01 of 9See more

workadventure workadventure 1.1.0

1 of the 9 container images this version deploys carry GHSA-x3cc-x39p-42qx.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
fast-xml-parser@3.21.1
4.1.2

Open the chart page →

16,083

Container images carrying it

24 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mongo-express:1.0.2:latest1b23d7976f02
fast-xml-parser@4.0.11
4.1.2
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
fast-xml-parser@3.21.1
4.1.2
2
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
fast-xml-parser@4.0.11
4.1.2
1
cryptexlabs/authf:0.12.11189c07411d7c
fast-xml-parser@3.21.1
4.1.2
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
fast-xml-parser@3.21.1
4.1.2
1
ethpandaops/blobscan:latest7a9ab6370657
fast-xml-parser@4.0.11
4.1.2
1
ethpandaops/blobscan-indexer:latestc58eb9ffe446
fast-xml-parser@4.0.11
4.1.2
1
ianw/quickchart:v1.7.1dc49dd460c37
fast-xml-parser@3.21.1
4.1.2
1
joplin/server:latest3f7b852959aa
fast-xml-parser@3.21.1
4.1.2
1
joplin/server:3.0-beta52af57880c0e
fast-xml-parser@3.21.1
4.1.2
1
joplin/server:2.14.2-betab87564ef34e9
fast-xml-parser@3.21.1
4.1.2
1
library/ghost:4.37.0767230c0f263
fast-xml-parser@3.19.0
4.1.2
1
library/ghost:5.79.083f7bf209844
fast-xml-parser@4.0.11
4.1.2
1
library/mongo-express:1.0.2-20-alpine3.191aae00775251
fast-xml-parser@4.0.11
4.1.2
1
lukasreining/open-api-schema-collector:0.1.050e021c42e33
fast-xml-parser@4.0.11
4.1.2
1
misskey/misskey:12.110.1e08b7c478093
fast-xml-parser@3.19.0
4.1.2
1
n8nio/n8n:0.212.0a9195bc499a3
fast-xml-parser@4.0.11
4.1.2
1
shinobisystems/shinobi:dev3ca746937856
fast-xml-parser@3.19.0
4.1.2
1
shinobisystems/shinobi:latestc2f5ce2e1067
fast-xml-parser@3.19.0
4.1.2
1
thecodingmachine/workadventure-back:v1.17.764001369dad5
fast-xml-parser@3.21.1
4.1.2
1
thingsboard/tb-js-executor:3.4.113e1eadf8ace
fast-xml-parser@3.19.0
4.1.2
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
fast-xml-parser@3.19.0
4.1.2
1
ghcr.io/k10app/catalog:latest639c980be0f1
fast-xml-parser@4.0.11
4.1.2
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
fast-xml-parser@4.0.11
4.1.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.