CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution

🗓️ 08 Jul 2025 21:39:59Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Helm prior to v3.18.4 allows local code execution via crafted Chart.yaml and Chart.lock files.

Reporter	Title	Published	Views	Family All 155
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	7 Aug 202508:11	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to local code execution due to the Helm package manager (CVE-2025-53547)	20 Nov 202514:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	28 Oct 202505:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	21 Oct 202514:44	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion	19 Dec 202520:44	–	ibm
GithubExploit	Exploit for CVE-2025-53547	9 Jul 202509:03	–	githubexploit
AlpineLinux	CVE-2025-53547	8 Jul 202521:39	–	alpinelinux
Information Security Automation	August Linux Patch Wednesday	4 Sep 202508:28	–	avleonov
CBLMariner	CVE-2025-53547 affecting package helm for versions less than 3.14.2-7	16 Jul 202515:08	–	cbl_mariner
Chainguard	CVE-2025-53547 vulnerabilities	9 Jul 202513:16	–	cgr

Source	Link
news	www.news.ycombinator.com/item
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53547.json
github	www.github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-53547
github	www.github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571

29 May 2026 18:29Current

7.2High risk

Vulners AI Score7.2

CVSS 3.18.5

EPSS0.00023

helm package manager local code execution chart.yaml vulnerability chart.lock symlink issue helm v3.18.4