StackRadar

GHSA-xffm-g5w8-qvg7

Low

Advisory

Published 18 Jul 2025In the index since 8 Sept 2026
Severity
Low
worst across findings
CVSS
2.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
10
of 17,781 indexed, latest versions
Container images
11
deployed by those charts
Fix available
1 of 1
affected package

@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser

Carried by container images the latest versions of 10 of 17,781 indexed charts deploy, on 11 images.

Affected packageAffected versionsFixed inImages
@eslint/plugin-kitnpm0.1.0, 0.2.0, 0.2.4, 0.2.5+3 more0.3.411
OSV records
GHSA-xffm-g5w8-qvg7

Charts affected

10 by stars
ChartLatestAffected imagesRadar Score
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
alazidis/stornx:1.1.1602d4f7f090c
@eslint/plugin-kit@0.2.8
0.3.4

Open the chart page →

11,574
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
@eslint/plugin-kit@0.2.8
0.3.4
sysnet4admin/colosseum-prm:log5802bfcd7fed
@eslint/plugin-kit@0.2.8
0.3.4

Open the chart page →

26,996
desishowbiz-frontenddesishowbiz1.0.01 of 1See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
rahulbhiwagade122/desishowbiz:latest08490b70998c
@eslint/plugin-kit@0.2.5
0.3.4

Open the chart page →

2,529
dumpstoredumpstore0.1.12 of 2See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
@eslint/plugin-kit@0.3.3
0.3.4
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@eslint/plugin-kit@0.2.0
0.3.4

Open the chart page →

4,251
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
@eslint/plugin-kit@0.2.8
0.3.4

Open the chart page →

5,769
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
@eslint/plugin-kit@0.3.2
0.3.4

Open the chart page →

14,809
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
@eslint/plugin-kit@0.3.2
0.3.4

Open the chart page →

2,318
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@eslint/plugin-kit@0.1.0
0.3.4

Open the chart page →

3,271
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
sharanalwar/redchef-frontend:latest5e82950b16b7
@eslint/plugin-kit@0.2.8
0.3.4

Open the chart page →

4,763
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry GHSA-xffm-g5w8-qvg7.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
@eslint/plugin-kit@0.2.4
0.3.4

Open the chart page →

7,084

Container images carrying it

11 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
@eslint/plugin-kit@0.3.2
0.3.4
2
alazidis/stornx:1.1.1602d4f7f090c
@eslint/plugin-kit@0.2.8
0.3.4
1
anamskenneth/recipe_frontend:2025-06-079ecf04f42cc3
@eslint/plugin-kit@0.1.0
0.3.4
1
automatischio/automatisch:0.15.03bace7a12d5f
@eslint/plugin-kit@0.2.8
0.3.4
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
@eslint/plugin-kit@0.2.5
0.3.4
1
sharanalwar/redchef-frontend:latest5e82950b16b7
@eslint/plugin-kit@0.2.8
0.3.4
1
sysnet4admin/colosseum-cms:loge74b43c7f492
@eslint/plugin-kit@0.2.8
0.3.4
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
@eslint/plugin-kit@0.2.8
0.3.4
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
@eslint/plugin-kit@0.2.4
0.3.4
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
@eslint/plugin-kit@0.3.3
0.3.4
1
ghcr.io/manzil-infinity180/frontend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b44e6394b715d9
@eslint/plugin-kit@0.2.0
0.3.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.