Skip to content
Sign in
4.8 Medium

CVE-2026-35206 Helm is a package manager for Charts for Kubernetes

Description

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

Affected products and versions

Product Affected versions Fixed in
helm 4.0 4.0.0 → < 4.1.4 4.1.4
helm 3.20 earliest → < 3.20.2 3.20.2

Other CVEs of helm

The 25 CVEs of helm →
CVE-2026-63308 Helm Files.Lines Denial of Service via Empty Chart Files 5.3 Medium CVE-2026-35205 Helm is a package manager for Charts for Kubernetes 8.4 High CVE-2026-35204 Helm is a package manager for Charts for Kubernetes 8.4 High CVE-2025-55198 Helm is a package manager for Charts for Kubernetes 6.5 Medium
Track this CVE