| id: GO-2026-5666 | |
| modules: | |
| - module: helm.sh/helm/v4 | |
| versions: | |
| - introduced: 4.0.0 | |
| - fixed: 4.1.4 | |
| vulnerable_at: 4.1.3 | |
| packages: | |
| - package: helm.sh/helm/v4/internal/plugin | |
| symbols: | |
| - Metadata.Validate | |
| - MetadataLegacy.Validate | |
| - MetadataV1.Validate | |
| derived_symbols: | |
| - ExtractTgzPluginMetadata | |
| - FindPlugin | |
| - FindPlugins | |
| - LoadAll | |
| - LoadDir | |
| - SignPlugin | |
| summary: |- | |
| Helm path traversal in plugin metadata version enables arbitrary file write | |
| outside Helm plugin directory in helm.sh/helm | |
| cves: | |
| - CVE-2026-35204 | |
| ghsas: | |
| - GHSA-vmx8-mqv2-9gmg | |
| references: | |
| - advisory: https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg | |
| - fix: https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027 | |
| - web: https://github.com/helm/helm/releases/tag/v4.1.4 | |
| source: | |
| id: GHSA-vmx8-mqv2-9gmg | |
| created: 2026-07-23T19:02:12.84094-04:00 | |
| review_status: REVIEWED |