CVE-2026-63308

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, flux-kustomize-controller, apisix-ingress-controller, kube-metrics-adapter, tetragon, cluster-api-helm-controller, tekton-pipelines, cert-manager-istio-csr, calico, cluster-api-provider-vsphere, opentelemetry-operator,...

CVE-2026-76229

A flaw was found in Renovate. This arbitrary command injection vulnerability exists within the kustomize manager, where user-provided chart names are not properly sanitized before being used in helm pull commands. An attacker with write access to a repository can exploit this by crafting maliciou...

CVE-2026-76229

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2024-58376

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2026-76232

Renovate's helmv3 manager appends the unsanitized repository parameter to helm registry login commands. An attacker with repository write access can craft a malicious Chart.yaml to inject arbitrary commands, executing them on the Renovate host. CVSS 3.1 scores 6.7 (MEDIUM) with HIGH impact across...

CVE-2026-76229

Renovate (dependency update bot) versions from 39.218.9 (March 26, 2025) before 40.33.0 contain an arbitrary command injection in the kustomize manager . The depName argument passed to the helmRepositoryArgs function in lib/modules/manager/kustomize/artifacts.ts is not escaped using shlex.quote b...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2026-76229 Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

EUVD-2026-62470

Renovate versions from 39.218.0 before 40.33.0 contain an arbitrary command injection vulnerability in the kustomize manager where user-provided chart names are appended to helm pull commands without proper sanitization. Attackers with repository write access can craft malicious kustomization.yam...

CVE-2024-58376

Renovate versions 37.158.0 through 37.198.0 are affected by a command injection vulnerability in the helmv3 manager's registryAliases handling. Since PR #26848 made registryAliases mergeable, the helmv3 manager executes helm repo add for each defined alias. The key was not quoted , allowing att...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, terraform-provider-sendgrid, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev, polaris, sftpgo, tetragon,...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: cue, cilium-cli, gh, kubernetes-ingress-defaultbackend, polaris, trino, buildah, docker-machine-driver-linode, dataplaneapi, mattermost, timestamp-authority, grafana-rollout-operator, vale, vt-cli, crane, chart-testing, esbuild, kserve-rest-proxy,...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, neuvector-dbgen, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, local-path-provisioner, mountpoint-s3-csi-driver, polaris,...

GO-2026-6091 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, terraform-provider-sendgrid, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev, polaris, sftpgo, tetragon,...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, cue, cloudprober, flux-kustomize-controller, terraform-provider-sendgrid, cilium-cli, kube-metrics-adapter, golangci-lint, gh, seaweedfs, spire-server, crossplane-provider-aws-sns, go-discover, dagdotdev, polaris, sftpgo, tetragon,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: cue, cilium-cli, gh, kubernetes-ingress-defaultbackend, polaris, trino, buildah, docker-machine-driver-linode, dataplaneapi, mattermost, timestamp-authority, grafana-rollout-operator, vale, vt-cli, crane, chart-testing, esbuild, kserve-rest-proxy,...