PT-2025-28768 · Helm+2 · Helm+2
Jake-Ciolek
·
Published
2025-07-08
·
Updated
2026-04-01
·
CVE-2025-53547
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Helm versions prior to 3.18.4
Description:
A specially crafted
Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file can be crafted to cause execution if the content were in a file that is executed, such as a bash.rc file or shell script. If the Chart.lock file is symlinked to one of these files, updating dependencies will write the lock file content to the symlinked file, leading to unwanted execution. This issue affects when dependencies are updated, for example, when helm dependency update is run.Recommendations:
For Helm versions prior to 3.18.4, ensure the
Chart.lock file in a chart is not a symlink prior to updating dependencies.
Update to Helm v3.18.4 to resolve the issue.Exploit
Fix
LPE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helm
Red Os
Suse