Arbitrary Code Execution

github.com/helm/helm is vulnerable to arbitrary code execution. Duplicate plugin entries allows an attacker to compromise a plugin's install hooks, via a man-in-the-middle attack, and possibly execute arbitrary code on the host OS...

CVE-2020-15187 Duplicate plugin entries in Helm

In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform thi...

PT-2020-14258 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 2.16.11 Helm versions prior to 3.3.2 Description: A Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs...