Arbitrary File Write Vulnerability in Helm Package Manager

CVE-2026-35204

What is CVE-2026-35204?

A security issue has been identified in Helm, the package manager for Kubernetes Charts. Versions 4.0.0 through 4.1.3 are impacted by a flaw that allows a specially crafted Helm plugin to write files to arbitrary locations on the filesystem when installed or updated. To mitigate this risk, it is crucial to validate that the 'plugin.yaml' file of any Helm plugin does not contain a 'version:' field with POSIX dot-dot path separators (e.g., '/../'). This vulnerability has been resolved in version 4.1.4, which should be updated to ensure security.

References