Helm vulnerable to Code Injection through malicious chart.yaml content

🗓️ 08 Jul 2025 23:20:54Reported by GitHub Advisory DatabaseType

Helm vulnerable to Code Injection via malicious Chart.yaml leading to local code execution risks

Reporter	Title	Published	Views	Family All 155
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	7 Aug 202508:11	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to local code execution due to the Helm package manager (CVE-2025-53547)	20 Nov 202514:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	28 Oct 202505:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	21 Oct 202514:44	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm
GithubExploit	Exploit for CVE-2025-53547	9 Jul 202509:03	–	githubexploit
AlpineLinux	CVE-2025-53547	8 Jul 202521:39	–	alpinelinux
Information Security Automation	August Linux Patch Wednesday	4 Sep 202508:28	–	avleonov
CBLMariner	CVE-2025-53547 affecting package helm for versions less than 3.14.2-7	16 Jul 202515:08	–	cbl_mariner
Chainguard	CVE-2025-53547 vulnerabilities	9 Jul 202513:16	–	cgr

Vulners

Node

helm v3Range<3.17.4go

helm v3Range3.18.0-rc.1–3.18.4go

Source	Link
github	www.github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm
github	www.github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-53547
news	www.news.ycombinator.com/item
github	www.github.com/advisories/GHSA-557j-xg8c-q2mm

16 Jul 2025 21:10Current

7.7High risk

Vulners AI Score7.7

CVSS 3.18.5 - 8.6

EPSS0.00023

SSVC