Helm: Crafted Chart.yaml plus a symlinked Chart.lock gives local code execution when dependencies are updated

Impact

Crafted Chart.yaml plus a symlinked Chart.lock gives local code execution when dependencies are updated; compromises the CD runner

Who can reach it

Malicious chart pulled by a GitOps pipeline

What to do

Upgrade Helm to 3.18.4+ everywhere charts are rendered, including Argo CD and Flux images

References

Related entries

• Helm: Crafted plugin writes its contents to an arbitrary filesystem location on install or updateCVE-2026-35204 · HelmHigh
• Helm: Helm installs plugins with no provenance file even when signature verification is requiredCVE-2026-35205 · HelmHigh
• Helm: Uninitialized variable panic parsing index and plugin YAMLCVE-2024-26147 · HelmHigh
• Helm: Helm repository credentials leaked to a redirected third-party hostCVE-2021-32690 · HelmMedium
• Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium
• Helm: OOM panic in the strvals package from crafted `--set` inputCVE-2022-36055 · HelmMedium