| id: GO-2026-5666 |
| modules: |
| - module: helm.sh/helm/v4 |
| versions: |
| - introduced: 4.0.0 |
| - fixed: 4.1.4 |
| vulnerable_at: 4.1.3 |
| packages: |
| - package: helm.sh/helm/v4/internal/plugin |
| symbols: |
| - Metadata.Validate |
| - MetadataLegacy.Validate |
| - MetadataV1.Validate |
| derived_symbols: |
| - ExtractTgzPluginMetadata |
| - FindPlugin |
| - FindPlugins |
| - LoadAll |
| - LoadDir |
| - SignPlugin |
| summary: |- |
| Helm path traversal in plugin metadata version enables arbitrary file write |
| outside Helm plugin directory in helm.sh/helm |
| cves: |
| - CVE-2026-35204 |
| ghsas: |
| - GHSA-vmx8-mqv2-9gmg |
| references: |
| - advisory: https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg |
| - fix: https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027 |
| - web: https://github.com/helm/helm/releases/tag/v4.1.4 |
| source: |
| id: GHSA-vmx8-mqv2-9gmg |
| created: 2026-07-23T19:02:12.84094-04:00 |
| review_status: REVIEWED |
