BIT-helm-2020-15186

    Dashboard / Vulnerabilities / BIT-helm-2020-15186

    BIT-helm-2020-15186

    Published: 6 Mar 2024Last Modified: 8 Sept 2026

    Summary: Improper sanitization of plugin names in Helm

    Details: In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

    References: https://github.com/helm/helm/commit/809e2d999e2c33e20e77f6bff30652d79c287542, https://github.com/helm/helm/security/advisories/GHSA-m54r-vrmv-hw33, https://nvd.nist.gov/vuln/detail/CVE-2020-15186

    Affected packages

    Package

    Name: helm

    Purl: pkg:bitnami/helm

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 2.0.0
    Fixed -2.16.11

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    BIT-helm-2020-15186 | CVE-DB