CVE-2025-53547 Details
Description
Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.
A local code execution vulnerability exists in Helm versions prior to 3.18.4. This issue arises when a specially crafted Chart.yaml file is used in conjunction with a symlinked Chart.lock file. The vulnerability allows for the execution of arbitrary code when dependencies are updated. The exploitation involves crafting a Chart.yaml file that, when processed, executes code if the same content is placed in an executable file, such as a bash startup file or shell script. When the Chart.lock file is updated, it can overwrite the symlinked file with the malicious content, leading to unintended code execution.
Users should ensure that the Chart.lock file is not a symlink before updating dependencies. This vulnerability has been patched in Helm versions 3.18.4 and 3.17.4.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://news.ycombinator.com/item?id=44506696 | CVE | Issue Tracking |
| https://github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571 | [email protected] | Patch |
| https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| helm helm | < 3.17.4 >= 3.18.0, < 3.18.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2025 | Initial Analysis | [email protected] |
| Jul 9, 2025 | CVE Modified | CVE |
| Jul 8, 2025 | New CVE Received | [email protected] |