helm.sh/helm/v4
Activity
- Latest release
- 4d ago
- Total releases
- 24
- Cadence
- ~14 days
- Last 12 months
- 23
Details
- First release
- Sep 02, 2025
| Version | Released | |
|---|---|---|
v4.3.0
minor
|
v4.3.0
minor
Dependencies (47)
+ 39 more |
|
v4.3.0-rc.1
pre
|
v4.3.0-rc.1
pre
Dependencies (47)
+ 39 more |
|
v4.2.4
patch
|
v4.2.4
patch
Dependencies (47)
+ 39 more |
|
v4.2.3
patch
|
v4.2.3
patch
Dependencies (47)
+ 39 more |
|
v4.2.2
patch
|
v4.2.2
patch
Dependencies (47)
+ 39 more |
|
v4.2.1
patch
|
v4.2.1
patch
Dependencies (47)
+ 39 more |
|
v4.2.0
minor
|
v4.2.0
minor
Dependencies (47)
+ 39 more |
|
v4.2.0-rc.1
pre
|
v4.2.0-rc.1
pre
Dependencies (47)
+ 39 more |
|
v4.1.4
patch
|
v4.1.4
patch
Dependencies (47)
+ 39 more |
|
v4.1.3
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.1.3
patch
Dependencies (47)
+ 39 more |
|
v4.1.2
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.1.2
patch
Dependencies (47)
+ 39 more |
|
v4.1.1
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.1.1
patch
Dependencies (47)
+ 39 more |
|
v4.0.5
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.5
patch
Dependencies (48)
+ 40 more |
|
v4.1.0
minor
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.1.0
minor
Dependencies (47)
+ 39 more |
|
v4.1.0-rc.1
pre
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.1.0-rc.1
pre
Dependencies (47)
+ 39 more |
|
v4.0.4
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.4
patch
Dependencies (48)
+ 40 more |
|
v4.0.3
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.3
patch
Dependencies (48)
+ 40 more |
|
v4.0.2
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.2
patch
Dependencies (48)
+ 40 more |
|
v4.0.1
patch
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.1
patch
Dependencies (48)
+ 40 more |
|
v4.0.0-rc.1
pre
1 CVE
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.0-rc.1
pre
Dependencies (48)
+ 40 more |
|
v4.0.0
initial
3 CVEs
CVE-2026-35205
GO-2026-5566
BIT-helm-2026-35205
GHSA-q5jf-9vfq-h4h7
Jul 24, 2026
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35204
GO-2026-5666
BIT-helm-2026-35204
GHSA-vmx8-mqv2-9gmg
Jul 24, 2026
Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm Fixed in
4.1.4
References Updated Jul 24, 2026 · Source: OSV.dev
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.0
initial
Dependencies (48)
+ 40 more |
|
v4.0.0-beta.2
pre
1 CVE
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.0-beta.2
pre
Dependencies (48)
+ 40 more |
|
v4.0.0-beta.1
pre
1 CVE
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.0-beta.1
pre
Dependencies (48)
+ 40 more |
|
v4.0.0-alpha.1
pre
1 CVE
CVE-2026-35206
GHSA-hr2v-4r36-88hr
BIT-helm-2026-35206
GO-2026-5435
Apr 10, 2026
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Medium
Local
Low
None
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause ImpactThe bug enables writing the Chart's contents (unpackaged/untar'ed) to the output directory Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. PatchesThis issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. WorkaroundsEnsure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the CreditsOleh Konko @1seal Fixed in
4.1.4
References Updated Sep 10, 2026 · Source: OSV.dev |
v4.0.0-alpha.1
pre
Dependencies (47)
+ 39 more |