CVE-2025-53547: helm Code Injection

CVSS: 8.6v3.1HighAnalyzed

AliasesSUSE-SU-2025:20595-1CGA-24wh-4f4x-j96mCGA-2635-vmp2-5xwq+460 more

Published 08-07-2025Last modified 26-02-2026

Vulnerability summary

CVE-2025-53547 is a high (CVSS 8.6) Code Injection vulnerability in helm. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.

Overall risk

34/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v3.1 (NVD)

EPSS score

0.46%

0%100%

Low · +0.08 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 49

OPENSUSE-SU-2025:15405-1 OPENSUSE-SU-2025:15779-1 OPENSUSE-SU-2025:20117-1 SUSE-SU-2025:20516-1 SUSE-SU-2025:4190-1 CGA-28C3-6PCM-WJ3H+43 more

Timeline

08-07-2025
PublishedVulnerability first disclosed.
26-02-2026
Last modifiedVulnerability information updated.

Description

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.

CVSS metrics

5 scores · 5 sources · 1 version

v3.18.6

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

+0.08 pp

From 0.38% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Chainguard200 products

cerbos< 0.45.1-r1
cerbos-compat< 0.45.1-r1
cerbos-fips< 0.45.1-r1
cerbosctl< 0.45.1-r1
cerbosctl-compat< 0.45.1-r1

cerbosctl-fips< 0.45.1-r1
cert-manager-cmctl< 2.2.0-r2
cert-manager-cmctl-fips< 2.2.0-r2
chart-testing< 3.13.0-r3
chart-testing-fips< 3.13.0-r3
chartmuseum< 0.16.3-r3
chartmuseum-fips< 0.16.3-r2
cilium-cli< 0.18.5-r1
cluster-api-helm-controller< 0.4.1-r1
cluster-api-helm-controller-fipsAll versions (No fix recorded)
cluster-api-helm-controller-fips-compatAll versions (No fix recorded)
consul-k8s-1.1< 1.1.18-r14
consul-k8s-1.1-cli< 1.1.18-r14
consul-k8s-1.3< 1.3.9-r15
consul-k8s-1.3-cli< 1.3.9-r15
consul-k8s-1.4< 1.4.10-r2
consul-k8s-1.4-cli< 1.4.10-r2
consul-k8s-1.5< 1.5.9-r1
consul-k8s-1.5-cli< 1.5.9-r1
consul-k8s-1.6< 1.6.6-r1
consul-k8s-1.6-cli< 1.6.6-r1
consul-k8s-1.7< 1.7.2-r1
consul-k8s-1.7-cli< 1.7.2-r1
consul-k8s-fips-1.1< 1.1.18-r13
consul-k8s-fips-1.1-cli< 1.1.18-r13
consul-k8s-fips-1.3< 1.3.9-r14
consul-k8s-fips-1.3-cli< 1.3.9-r14
consul-k8s-fips-1.4< 1.4.10-r2
consul-k8s-fips-1.4-cli< 1.4.10-r2
consul-k8s-fips-1.5< 1.5.9-r1
consul-k8s-fips-1.5-cli< 1.5.9-r1
consul-k8s-fips-1.6< 1.6.6-r2
consul-k8s-fips-1.6-cli< 1.6.6-r2
consul-k8s-fips-1.7< 1.7.2-r1
consul-k8s-fips-1.7-cli< 1.7.2-r1
eksctl< 0.211.0-r0
envoy-gateway< 1.4.2-r1
envoy-gateway-compat< 1.4.2-r1
envoy-gateway-egctl< 1.4.2-r1
envoy-gateway-fips< 1.4.2-r0
envoy-gateway-fips-egctl< 1.4.2-r0
flux-2.6< 2.6.4-r1
flux-2.6-compat< 2.6.4-r1
flux-fips-2.5< 2.5.1-r8
flux-fips-2.5-compat< 2.5.1-r8
flux-fips-2.6< 2.6.4-r0
flux-fips-2.6-compat< 2.6.4-r0
flux-helm-controller< 1.3.0-r4
flux-helm-controller-fips< 1.3.0-r4
flux-helm-controller-iamguarded-compat< 1.3.0-r4
flux-source-controller< 1.6.2-r2
flux-source-controller-fips< 1.6.2-r3
flux-source-controller-iamguarded-compat< 1.6.2-r2
gem-check< 0.0.18-r1
gosh< 0.0.18-r1
harbor-2.11< 2.11.2-r12
harbor-2.11-exporter< 2.11.2-r12
harbor-2.11-jobservice< 2.11.2-r12
harbor-2.11-photon-registry< 2.11.2-r12
harbor-2.11-portal< 2.11.2-r12
harbor-2.11-portal-nginx-config< 2.11.2-r12
harbor-2.11-redis-compat< 2.11.2-r12
harbor-2.11-registryctl< 2.11.2-r12
harbor-2.12< 2.12.4-r3
harbor-2.12-exporter< 2.12.4-r3
harbor-2.12-jobservice< 2.12.4-r3
harbor-2.12-photon-registry< 2.12.4-r3
harbor-2.12-portal< 2.12.4-r3
harbor-2.12-portal-nginx-config< 2.12.4-r3
harbor-2.12-redis-compat< 2.12.4-r3
harbor-2.12-registryctl< 2.12.4-r3
harbor-2.13< 2.13.1-r4
harbor-2.13-exporter< 2.13.1-r4
harbor-2.13-jobservice< 2.13.1-r4
harbor-2.13-photon-registry< 2.13.1-r4
harbor-2.13-portal< 2.13.1-r4
harbor-2.13-portal-nginx-config< 2.13.1-r4
harbor-2.13-redis-compat< 2.13.1-r4
harbor-2.13-registryctl< 2.13.1-r4
harbor-fips-2.11< 2.11.2-r15
harbor-fips-2.11-db< 2.11.2-r15
harbor-fips-2.11-exporter< 2.11.2-r15
harbor-fips-2.11-jobservice< 2.11.2-r15
harbor-fips-2.11-photon-registry< 2.11.2-r15
harbor-fips-2.11-portal< 2.11.2-r15
harbor-fips-2.11-redis-compat< 2.11.2-r15
harbor-fips-2.11-registryctl< 2.11.2-r15
harbor-fips-2.12< 2.12.4-r3
harbor-fips-2.12-db< 2.12.4-r3
harbor-fips-2.12-exporter< 2.12.4-r3
harbor-fips-2.12-jobservice< 2.12.4-r3
harbor-fips-2.12-photon-registry< 2.12.4-r3
harbor-fips-2.12-portal< 2.12.4-r3
harbor-fips-2.12-redis-compat< 2.12.4-r3
harbor-fips-2.12-registryctl< 2.12.4-r3
harbor-fips-2.13< 2.13.1-r4
harbor-fips-2.13-db< 2.13.1-r4
harbor-fips-2.13-exporter< 2.13.1-r4
harbor-fips-2.13-jobservice< 2.13.1-r4
harbor-fips-2.13-photon-registry< 2.13.1-r4
harbor-fips-2.13-portal< 2.13.1-r4
harbor-fips-2.13-redis-compat< 2.13.1-r4
harbor-fips-2.13-registryctl< 2.13.1-r4
header-check< 0.0.18-r1
helm-docs< 1.14.2-r10
helm-operator< 1.41.1-r0
helm-operator-compat< 1.41.1-r0
helm-operator-fips< 1.41.1-r0
helm-operator-fips-compat< 1.41.1-r0
helm-push< 0.10.4-r30
help-check< 0.0.18-r1
istio-1.26< 1.26.2-r1
istio-cni-1.26< 1.26.2-r1
istio-cni-1.26-compat< 1.26.2-r1
istio-install-cni-1.26< 1.26.2-r1
istio-install-cni-1.26-compat< 1.26.2-r1
istio-pilot-agent-1.25< 1.25.3-r3
istio-pilot-agent-1.25-compat< 1.25.3-r3
istio-pilot-agent-1.26< 1.26.2-r1
istio-pilot-agent-1.26-compat< 1.26.2-r1
istio-pilot-discovery-1.26< 1.26.2-r1
istio-pilot-discovery-1.26-compat< 1.26.2-r1
istioctl-1.26< 1.26.2-r1
istioctl-bash-completion-1.26< 1.26.2-r1
istioctl-zsh-completion-1.26< 1.26.2-r1
k8sgpt< 0.4.26-r0
k8ssandra-client< 0.8.3-r1 | < 0.8.3-r2
k8ssandra-client-fips< 0.8.3-r2
k9s< 0.50.7-r1
kargo< 1.6.0-r1
kargo-oci-compat< 1.6.0-r1
kots< 1.124.18-r2
kots-compat< 1.124.18-r2
kots-symlink-compat< 1.124.18-r2
kubevela-vela-cliAll versions (No fix recorded)
kubevela-vela-cli-fipsAll versions (No fix recorded)
kubevela-vela-coreAll versions (No fix recorded)
kubevela-vela-core-fipsAll versions (No fix recorded)
kuma-2.10< 2.10.2-r1
kuma-2.11< 2.11.2-r0
kuma-2.9< 2.9.6-r1
kuma-cni-2.10< 2.10.2-r1
kuma-cni-2.11< 2.11.2-r0
kuma-cni-2.9< 2.9.6-r1
kuma-cni-compat-2.10< 2.10.2-r1
kuma-cni-compat-2.11< 2.11.2-r0
kuma-cni-compat-2.9< 2.9.6-r1
kuma-cp-2.10< 2.10.2-r1
kuma-cp-2.11< 2.11.2-r0
kuma-cp-2.9< 2.9.6-r1
kuma-dp-2.10< 2.10.2-r1
kuma-dp-2.11< 2.11.2-r0
kuma-dp-2.9< 2.9.6-r1
kuma-install-cni-2.10< 2.10.2-r1
kuma-install-cni-2.11< 2.11.2-r0
kuma-install-cni-2.9< 2.9.6-r1
kumactl-2.10< 2.10.2-r1
kumactl-2.11< 2.11.2-r0
kumactl-2.7All versions (No fix recorded)
kumactl-2.9< 2.9.6-r1
ldd-check< 0.0.18-r1
linkerd2< 25.7.1-r1
linkerd2-cli< 25.7.1-r1
linkerd2-controller< 25.7.1-r1
linkerd2-controller-compat< 25.7.1-r1
linkerd2-debug< 25.7.1-r1
linkerd2-fips< 25.7.2-r0
linkerd2-fips-cli< 25.7.2-r0
linkerd2-fips-controller< 25.7.2-r0
linkerd2-fips-controller-compat< 25.7.2-r0
linkerd2-fips-metrics-api< 25.7.2-r0
linkerd2-fips-metrics-api-compat< 25.7.2-r0
linkerd2-fips-proxy-identity< 25.7.2-r0
linkerd2-fips-tap< 25.7.2-r0
linkerd2-fips-tap-compat< 25.7.2-r0
linkerd2-fips-web< 25.7.2-r0
linkerd2-metrics-api< 25.7.1-r1
linkerd2-metrics-api-compat< 25.7.1-r1
linkerd2-proxy-identity< 25.7.1-r1
linkerd2-tap< 25.7.1-r1
linkerd2-tap-compat< 25.7.1-r1
linkerd2-web< 25.7.1-r1
no-docs-check< 0.0.18-r1
package-type-check< 0.0.18-r1
pluto< 5.21.8-r2
pluto-compat< 5.21.8-r2
rancher-fleet< 0.12.4-r3
rancher-fleet-agent< 0.12.4-r3
rancher-fleet-agent-fips< 0.12.4-r4
rancher-fleet-cli< 0.12.4-r3
rancher-fleet-cli-fips< 0.12.4-r4
rancher-fleet-controller< 0.12.4-r3
rancher-fleet-controller-fips< 0.12.4-r4
rancher-fleet-fips< 0.12.4-r4
rancher-fleet-termination-log< 0.12.4-r3

Show all 200

1 vendor · 200 products · Showing 200 of 305. Use Open JSON for the complete list.

References

9 links

github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mmX Refsource CONFIRMAdvisoryWEBThird Party Advisory
github.com/helm/helm/commit/4b8e61093d8f579f1165cdc6bd4b43fa5455f571X Refsource MISCFIXWEBPatch
news.ycombinator.com/item?id=44506696WEBIssue Tracking
www.suse.com/support/update/announcement/2025/suse-su-202520595-1/Advisory
bugzilla.suse.com/1246152REPORT
www.suse.com/security/cve/CVE-2025-53547WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53547.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-53547AdvisoryOval
github.com/helm/helmPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities