Code Execution Vulnerability in Helm Package Manager Affects Kubernetes Deployments
CVE-2025-53547
Key Information:
Badges
What is CVE-2025-53547?
A critical vulnerability exists in Helm, a package manager for Kubernetes, prior to version 3.18.4. It allows for local code execution via a maliciously crafted Chart.yaml file linked to a Chart.lock file. When dependencies are updated, the fields in Chart.yaml can inadvertently carry over to the symlinked Chart.lock file, resulting in the execution of arbitrary commands if linked to executable files such as bash.rc or shell scripts. Although Helm issue warnings about symlinked files, it does not prevent execution, posing significant risks to Kubernetes environments. This vulnerability highlights the need for diligent sanitization of input files and proper version management.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
helm < 3.18.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved