Description
Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| helm | helm | < 3.18.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES 15 SP6 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES 15 SP5 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES 15 SP4 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES 15 SP3 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES for SAP 15 SP4 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLES for SAP 15 SP3 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLE Micro 6.1 | helm | 3.18.4-slfo.1.1_1.1 | SUSE-SU-2025:20595-1 |
| SLE Micro 6.0 | helm | 3.18.4-1.1 | SUSE-SU-2025:20516-1 |
| SLE Micro 5.5 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLE HPC 15 SP5 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLE HPC 15 SP4 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SLE HPC 15 SP3 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
| SUSE Enterprise Storage 7.1 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cmctl | 2.3.0-1.1 | openSUSE-SU-2025:15336-1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 | openSUSE-SU-2025:15405-1 |
| openSUSE Tumbleweed | helm | 3.18.4-1.1 | openSUSE-SU-2025:15331-1 |
| openSUSE Tumbleweed | helm3 | 3.19.2-1.1 | openSUSE-SU-2025:15779-1 |
| openSUSE Tumbleweed | k9s | 0.50.7-2.1 | openSUSE-SU-2025:15338-1 |
| openSUSE Tumbleweed | kubeshark-cli | 52.8.0-1.1 | openSUSE-SU-2025:15406-1 |
| openSUSE Tumbleweed | trivy | 0.64.1-1.1 | openSUSE-SU-2025:15341-1 |
| openSUSE Leap 15.6 | helm | 3.19.1-150000.1.57.1 | SUSE-SU-2025:4190-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | helm | 3.18.4-r0 | — |
| Alpine v3.23 | helm | 3.18.4-r0 | — |
| Alpine v3.22 | helm | 3.18.4-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | helm | 3.14.2-7 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cerbos +3 | 0.45.1-r1 | — |
| Wolfi rolling | cert-manager-cmctl | 2.2.0-r2 | — |
| Wolfi rolling | chart-testing | 3.13.0-r3 | — |
| Wolfi rolling | chartmuseum | 0.16.3-r3 | — |
| Wolfi rolling | cilium-cli | 0.18.5-r1 | — |
| Wolfi rolling | cluster-api-helm-controller | 0.4.1-r1 | — |
| Wolfi rolling | eksctl | 0.211.0-r0 | — |
| Wolfi rolling | envoy-gateway +2 | 1.4.2-r1 | — |
| Wolfi rolling | flux-helm-controller +1 | 1.3.0-r4 | — |
| Wolfi rolling | flux-source-controller +1 | 1.6.2-r2 | — |
| Wolfi rolling | helm-docs | 1.14.2-r10 | — |
| Wolfi rolling | helm-operator +1 | 1.41.1-r0 | — |
| Wolfi rolling | helm-push | 0.10.4-r30 | — |
| Wolfi rolling | istio-pilot-agent-1.25 +1 | 1.25.3-r3 | — |
| Wolfi rolling | k8sgpt | 0.4.26-r0 | — |
| Wolfi rolling | k8ssandra-client | 0.8.3-r1 | — |
| Wolfi rolling | k9s | 0.50.7-r1 | — |
| Wolfi rolling | kargo +1 | 1.6.0-r1 | — |
| Wolfi rolling | kots +2 | 1.124.18-r2 | — |
| Wolfi rolling | kubevela-vela-cli +1 | No fix yet | — |
| Wolfi rolling | linkerd2 +10 | 25.7.1-r1 | — |
| Wolfi rolling | pluto +1 | 5.21.8-r2 | — |
| Wolfi rolling | rancher-fleet +4 | 0.12.4-r3 | — |
| Wolfi rolling | rancher-helm-3 | 3.19.0-r1 | — |
| Wolfi rolling | trivy | 0.64.1-r1 | — |
| Wolfi rolling | tw +14 | 0.0.18-r1 | — |
| Wolfi rolling | zarf | 0.57.0-r2 | — |
| Wolfi rolling | zot | 2.1.5-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
DVKunion/CVE-2025-53547-POC ★ 9 · Jul 9, 2025
CVE-2025-53547 one of poc code
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | helm.sh/helm/v3 | >= 3.18.0-rc.1, < 3.18.4 | 3.18.4 | GHSA-557j-xg8c-q2mm |
| Go | helm.sh/helm/v3 | < 3.17.4 | 3.17.4 | GHSA-557j-xg8c-q2mm |
| Go | helm.sh/helm/v3 | < 3.18.4 | 3.18.4 | GO-2025-3802 |
Advisories 15
- WID-SEC-2025-2028 Red Hat OpenShift Container Platform: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 3, 2026
- openSUSE-SU-2025:15405-1 govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15406-1 kubeshark-cli-52.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15331-1 helm-3.18.4-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:4190-1 Security update for helm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20595-1 Security update for helm SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20516-1 Security update for helm SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15779-1 helm3-3.19.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15336-1 cmctl-2.3.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15341-1 trivy-0.64.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15338-1 k9s-0.50.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0165 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-2424 IBM Rational Team Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025