CVE-2025-53547

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated.

Impact

Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking.

This affects when dependencies are updated. When using the helm command this happens when helm dependency update is run. helm dependency build can write a lock file when one does not exist but this vector requires one to already exist. This affects the Helm SDK when the downloader Manager performs an update.

Patches

This issue has been resolved in Helm v3.18.4

Workarounds

Ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies.

For more information

Helm's security policy is spelled out in detail in our SECURITY document.

Credits

Disclosed by Jakub Ciolek at AlphaSense.

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

These are all security issues fixed in the helm-3.18.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cmctl-2.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the k9s-0.50.7-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.64.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubeshark-cli-52.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issues:

Changes in trivy:

Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):

• fix: Use fetch-level: 1 to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
• fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
• fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
• fix: add buildInfo for BlobInfo in rpc package [backport: release/v0.67] (#9615)
• fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
• fix(vex): don't suppress vulns for packages with infinity loop (#9465)
• fix(aws): use BuildableClient insead of xhttp.Client (#9436)
• refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
• docs: clarify inline ignore limitations for resource-less checks (#9537)
• fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
• fix(misconf): handle tofu files in module detection (#9486)
• feat(seal): add seal support (#9370)
• docs: fix modules path and update code example (#9539)
• fix: close file descriptors and pipes on error paths (#9536)
• feat: add documentation URL for database lock errors (#9531)
• fix(db): Dowload database when missing but metadata still exists (#9393)
• feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
• fix(misconf): unmark cty values before access (#9495)
• feat(cli): change --list-all-pkgs default to true (#9510)
• fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
• refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
• refactor: remove google/wire dependency and implement manual DI (#9509)
• chore(deps): bump the aws group with 6 updates (#9481)
• chore(deps): bump the common group across 1 directory with 24 updates (#9507)
• fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
• docs: move info about detection priority into coverage section (#9469)
• feat(sbom): added support for CoreOS (#9448)
• fix(misconf): strip build metadata suffixes from image history (#9498)
• feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
• docs: Fix typo in terraform docs (#9492)
• feat(redhat): add os-release detection for RHEL-based images (#9458)
• ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
• refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
• fix(vuln): compare nuget package names in lower case (#9456)
• chore: Update release flow to include chocolatey (#9460)
• docs: document eol supportability (#9434)
• docs(report): add nuanses about secret/license scanner in summary table (#9442)
• ci: use environment variables in GitHub Actions for improved security (#9433)
• chore: bump Go to 1.24.7 (#9435)
• fix(nodejs): use snapshot string as Package.ID for pnpm packages (#9330)
• ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)

Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):

• chore(deps): bump the aws group with 7 updates (#9419)
• refactor(secret): clarify secret scanner messages (#9409)
• fix(cyclonedx): handle multiple license types (#9378)
• fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
• test: add HTTP basic authentication to git test server (#9407)
• fix(sbom): add support for file component type of CycloneDX (#9372)
• fix(misconf): ensure module source is known (#9404)
• ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
• fix: create temp file under composite fs dir (#9387)
• chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
• refactor: switch to stable azcontainerregistry SDK package (#9319)
• chore(deps): bump the common…

This update for trivy fixes the following issues:

Update to version 0.68.2:

Security fixes:

• CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches (bsc#1227010).
• CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (bsc#1234512).
• CVE-2024-45338: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content (bsc#1235265).
• CVE-2024-51744: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232948).
• CVE-2025-11065: github.com/go-viper/mapstructure/v2: sensitive Information leak in logs (bsc#1250625).
• CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239225).
• CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239385).
• CVE-2025-22872: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241724).
• CVE-2025-27144: gopkg.in/go-jose/go-jose.v2: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237618).
• CVE-2025-30204: github.com/golang-jwt/jwt/v4,github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240466).
• CVE-2025-46569: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API (bsc#1246730).
• CVE-2025-47291: github.com/containerd/containerd/v2: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. (bsc#1243633).
• CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251363).
• CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253512).
• CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1253977).
• CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution (bsc#1246151).
• CVE-2025-58058: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory (bsc#1248937, bsc#1248897).
• CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253786).
• CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by html.ParseFragment when processing specially crafted input (bsc#1251547).

Other fixes:

• Update installation.md (#8979)
• chore(alpine): add EOL date for Alpine 3.21 (#8221)
• chore(alpine): add EOL date for Alpine 3.22 (#8992)
• chore(cli): Remove Trivy Cloud (#9847)
• chore(deps): Bump trivy-checks (#7819)
• chore(deps): Bump trivy-checks (#8310)
• chore(deps): Bump trivy-checks (#8619)
• chore(deps): Bump trivy-checks (#8934)
• chore(deps): Bump trivy-checks to v1.7.1 (#8467)
• chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
• chore(deps): Switch to go-viper/mapstructure (#9579)
• chore(deps): Update trivy-checks (#8798)
• chore(deps): Upgrade trivy-checks (#8018)
• chore(deps): bump Go to v1.23.5 (#8341)
• chore(deps): bump Go to v1.23.5 [backport: release/v0.59] (#8343)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 (#8105)
• chore(deps): bump github.com/CycloneDX/cyclonedx-go from v0.9.1 to v0.9.2 [backport: release/v0.58] (#8136)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 (#8140)
• chore(deps): bump golang.org/x/net from v0.32.0 to v0.33.0 [backport: release/v0.58] (#8142)
• chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
• chore(deps): bump alpine from…

This update for helm fixes the following issues:

Update to version 3.18.4 (bsc#1246152, CVE-2025-53547):

• Disabling linter due to unknown issue f20a4ad (Matt Farina)
• build(deps): bump the k8s-io group with 7 updates 563b094 (dependabot[bot])
• Updating link handling 00de613 (Matt Farina)

Update to version 3.18.3:

• build(deps): bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc (dependabot[bot])
• fix: user username password for login 5b9e2f6 (Terry Howe)
• Update pkg/registry/transport.go 2782412 (Terry Howe)
• Update pkg/registry/transport.go e66cf6a (Terry Howe)
• fix: add debug logging to oci transport 191f05c (Terry Howe)

Update to version 3.18.2:

• fix: legacy docker support broken for login 04cad46 (Terry Howe)
• Handle an empty registry config file. bc9f8a2 (Matt Farina)

Update to version 3.18.1:

• Notes:
  • This release fixes regressions around template generation and OCI registry interaction in 3.18.0
  • There are at least 2 known regressions unaddressed in this release. They are being worked on.
    • Empty registry configuration files. When the file exists but it is empty.
    • Login to Docker Hub on some domains fails.
• Changelog
  • fix(client): skipnode utilization for PreCopy
  • fix(client): layers now returns manifest - remove duplicate from descriptors
  • fix(client): return nil on non-allowed media types
  • Prevent fetching newReference again as we have in calling method
  • Prevent failure when resolving version tags in oras memory store
  • Update pkg/plugin/plugin.go
  • Update pkg/plugin/plugin.go
  • Wait for Helm v4 before raising when platformCommand and Command are set
  • Fix 3.18.0 regression: registry login with scheme
  • Revert "fix (helm) : toToml` renders int as float [ backport to v3 ]"

Update to version 3.18.0 (bsc#1241802, CVE-2025-22872):

• Notable Changes:

  • Add support for JSON Schema 2020
  • Enabled cpu and memory profiling
  • Add hook annotation to output hook logs to client on error

• Changelog:

  • build(deps): bump the k8s-io group with 7 updates
  • fix: govulncheck workflow
  • bump version to v3.18.0
  • fix:add proxy support when mTLS configured
  • docs: Note about http fallback for OCI registries
  • Bump net package to avoid CVE on dev-v3
  • Bump toml
  • backport #30677to dev3
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.2 to 1.8.0
  • Add install test for TakeOwnership flag
  • Fix --take-ownership
  • build(deps): bump github.com/rubenv/sql-migrate from 1.7.1 to 1.7.2
  • build(deps): bump golang.org/x/crypto from 0.36.0 to 0.37.0
  • build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0
  • Testing text bump
  • Permit more Go version and not only 1.23.8
  • Bumps github.com/distribution/distribution/v3 from 3.0.0-rc.3 to 3.0.0
  • Unarchiving fix
  • Fix typo
  • Report as debug log, the time spent waiting for resources
  • build(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27
  • Update pkg/registry/fallback.go
  • automatic fallback to http
  • chore(oci): upgrade to ORAS v2
  • Updating to 0.37.0 for x/net
  • build(deps): bump the k8s-io group with 7 updates
  • build(deps): bump golang.org/x/crypto from 0.35.0 to 0.36.0
  • build(deps): bump github.com/opencontainers/image-spec
  • build(deps): bump github.com/containerd/containerd from 1.7.25 to 1.7.26
  • build(deps): bump golang.org/x/crypto from 0.33.0 to 0.35.0
  • Fix cherry-pick helm.sh/helm/v4 -> helm.sh/helm/v3
  • Refactor based on review comment
  • Refactor based on review comment
  • Add HookOutputFunc and generic yaml unmarshaller
  • clarify fix error message
  • fix err check
  • remove comments about previous functionality
  • add short circuit return
  • Update based on review comments
  • Update…

This update for helm fixes the following issues:

Update to version 3.18.4 (bsc#1246152, CVE-2025-53547):

• Disabling linter due to unknown issue f20a4ad (Matt Farina)
• build(deps): bump the k8s-io group with 7 updates 563b094 (dependabot[bot])
• Updating link handling 00de613 (Matt Farina)

This update for helm fixes the following issues:

• Update to version 3.19.1
• CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152)
• CVE-2025-58190: Fixed excessive memory consumption by html.ParseFragment when processing specially crafted input. (bsc#1251649)
• CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents. (bsc#1251442)