modules:
  - module: helm.sh/helm/v3
    versions:
      - introduced: 3.0.0
        fixed: 3.5.2
    vulnerable_at: 3.5.1
    packages:
      - package: helm.sh/helm/v3/pkg/chart
        symbols:
          - Metadata.Validate
        derived_symbols:
          - Chart.Validate
      - package: helm.sh/helm/v3/pkg/plugin
        symbols:
          - validatePluginData
        derived_symbols:
          - FindPlugins
          - LoadAll
          - LoadDir
      - package: helm.sh/helm/v3/pkg/repo
        symbols:
          - IndexFile.Add
          - loadIndex
        derived_symbols:
          - ChartRepository.DownloadIndexFile
          - ChartRepository.Index
          - ChartRepository.Load
          - FindChartInAuthAndTLSRepoURL
          - FindChartInAuthRepoURL
          - FindChartInRepoURL
          - IndexDirectory
          - LoadIndexFile
description: |-
    Helm does not sanitize all fields read from repository data files.
    A maliciously crafted data file may contain strings containing arbitrary
    data. If printed to a terminal, a malicious string could obscure or alter
    data on the screen.
cves:
  - CVE-2021-21303
ghsas:
  - GHSA-c38g-469g-cmgx
references:
  - advisory: https://github.com/advisories/GHSA-c38g-469g-cmgx
  - fix: https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a