{"id":"CVE-2019-18658","aliases":["EUVD-2022-4688","GHSA-p5pc-m4q7-7qm9","GO-2023-1938","SUSE-SU-2022:1888-1","openSUSE-SU-2024:10842-1"],"status":"published","title":"Helm Unsafe Link Following","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01745,"percentile":0.77948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2019-11-12T13:20:13Z","modified":"2026-10-24T10:30:56Z","fixes":[{"ecosystem":"Go","package":"helm.sh/helm","fixed_in":["2.15.2","2.15.2+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"helm-mirror","fixed_in":["0.3.1-150000.1.13.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm-mirror","fixed_in":["0.3.1-150000.1.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"helm-mirror","fixed_in":["0.3.1-150000.1.13.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"helm-mirror","fixed_in":["0.3.1-150000.1.13.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.15.2"}]}]},{"source":"osv","ecosystem":"Go","package":"helm.sh/helm","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0+incompatible"},{"fixed":"2.15.2+incompatible"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.13.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-150000.1.13.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm-mirror","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.1-1.9"}]}],"bundled":4}],"products":[{"vendor":"helm","product":"helm"}],"references":[{"url":"https://helm.sh/blog/2019-10-30-helm-symlink-security-notice/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18658","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p5pc-m4q7-7qm9","tags":["advisory"]},{"url":"https://github.com/helm/helm","tags":["package"]},{"url":"https://helm.sh/blog/2019-10-30-helm-symlink-security-notice","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221888-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1156646","tags":["report"]},{"url":"https://bugzilla.suse.com/1197728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18658","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-18658","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2019-11-12T13:20:13Z","modified":"2024-08-05T01:54:14.598Z","updated_at":"2026-11-02T14:32:23.803059Z"}],"euvd":[{"id":"EUVD-2022-4688","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2019-11-12T13:20:13Z","modified":"2024-08-05T01:54:14Z","updated_at":"2026-11-03T02:40:27.733219Z"}],"ghsa":[{"id":"GHSA-p5pc-m4q7-7qm9","title":"Helm Unsafe Link Following","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as `/etc/passwd`, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2022-05-24T22:01:14Z","modified":"2023-09-26T19:48:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2019-18658","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2019-11-12T14:15:11.343Z","modified":"2026-06-17T02:25:14.56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"CVE-2019-18658","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2019-11-12T14:15:11.343Z","modified":"2026-10-24T10:30:56.756240053Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-p5pc-m4q7-7qm9","title":"Helm Unsafe Link Following","description":"In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as `/etc/passwd`, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.","status":"published","published":"2022-05-24T22:01:14Z","modified":"2024-08-20T20:58:38.061127Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"GO-2023-1938","title":"Helm Unsafe Link Following in helm.sh/helm","description":"Helm Unsafe Link Following in helm.sh/helm","status":"published","published":"2024-08-20T20:31:38Z","modified":"2026-03-03T04:53:59.593249Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"openSUSE-SU-2024:10842-1","title":"helm-mirror-0.3.1-1.9 on GA media","description":"These are all security issues fixed in the helm-mirror-0.3.1-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:45:55.431315Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2022:1888-1","title":"Security update for helm-mirror","description":"This update for helm-mirror fixes the following issues:\n\n- Updated to version 0.3.1:\n  - CVE-2019-18658: Fixed a potential symbolic link issue in helm that could be\n    used to leak sensitive files (bsc#1156646).\n","status":"published","published":"2022-05-31T08:44:57Z","modified":"2026-02-04T03:01:35.364793Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}