Low severity3.7NVD Advisory· Published Sep 17, 2020· Updated Jun 17, 2026
CVE-2020-15184
CVE-2020-15184
Description
In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the alias field on a Chart.yaml is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or (if used) does not contain newlines or path characters.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
helm.sh/helm/v3Go | >= 3.0.0, < 3.3.2 | 3.3.2 |
helm.sh/helmGo | < 2.16.11 | 2.16.11 |
Affected products
6- osv-coords4 versionspkg:bitnami/helmpkg:golang/helm.sh/helmpkg:golang/helm.sh/helm/v3pkg:rpm/suse/kubernetes&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP1
>= 2.0.0, < 2.16.11+ 3 more
- (no CPE)range: >= 2.0.0, < 2.16.11
- (no CPE)range: < 2.16.11
- (no CPE)range: >= 3.0.0, < 3.3.2
- (no CPE)range: < 1.17.13-4.21.2
Patches
Vulnerability mechanics
References
5- github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850nvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-9vp5-m38w-j776ghsaADVISORY
- github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-15184ghsaADVISORY
- github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946ghsaWEB
News mentions
0No linked articles in our index yet.