CVE-2026-35206

Name
CVE-2026-35206
Description
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436
security-advisories@github.com https://github.com/helm/helm/releases/tag/v4.1.4
security-advisories@github.com https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* helm >= None < 3.20.2
cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* helm >= 4.0.0 < 4.1.4

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
helm edge-community 3.19.0-r6 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r5 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r4 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r3 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r2 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r1 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.19.0-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.6-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.4-r2 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.4-r1 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.4-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.3-r1 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.3-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.2-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.18.0-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.2-r3 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.2-r2 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.2-r1 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.2-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.1-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.0-r2 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.0-r1 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.17.0-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.16.3-r0 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm edge-community 3.6.1-r0 None possibly vulnerable
helm edge-community 3.6.0-r0 None possibly vulnerable
helm 3.23-community 3.19.0-r6 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm 3.23-community 3.19.0-r5 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm 3.23-community 3.19.0-r4 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm 3.23-community 3.19.0-r3 techknowlogick <techknowlogick@gitea.com> possibly vulnerable
helm 3.23-community 3.19.0-r2 techknowlogick <techknowlogick@gitea.com> possibly vulnerable