Skip to main content
cve.nowby Sazabi
← Go
GoPackage

helm.sh/helm/v4

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 2 high, 1 medium
Registry
pkg.go.dev

Advisories 3

  • CVE-2026-35206Medium 4.8

    Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

    Affected: fixed in 4.1.4.

  • Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

    Affected: from 4.0.0, fixed in 4.1.4.

  • Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

    Affected: from 4.0.0, fixed in 4.1.4.