Code Execution Vulnerability in Helm Package Manager Affects Kubernetes Deployments

CVE-2025-53547

What is CVE-2025-53547?

A critical vulnerability exists in Helm, a package manager for Kubernetes, prior to version 3.18.4. It allows for local code execution via a maliciously crafted Chart.yaml file linked to a Chart.lock file. When dependencies are updated, the fields in Chart.yaml can inadvertently carry over to the symlinked Chart.lock file, resulting in the execution of arbitrary commands if linked to executable files such as bash.rc or shell scripts. Although Helm issue warnings about symlinked files, it does not prevent execution, posing significant risks to Kubernetes environments. This vulnerability highlights the need for diligent sanitization of input files and proper version management.

References