VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Aug 13, 2025· Updated Aug 14, 2025

Helm May Panic Due To Incorrect YAML Content

CVE-2025-55198

Description

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
helm.sh/helm/v3Go
< 3.18.53.18.5

Affected products

1

Patches

1
ec5f59e2db56

Merge commit from fork

https://github.com/helm/helmRobert SirchiaAug 13, 2025via ghsa
commit
5 files changed · +18 −2
  • pkg/chartutil/dependencies.go+3 −2 modified
    @@ -16,6 +16,7 @@ limitations under the License.
 package chartutil
 
 import (
+	"fmt"
 	"log"
 	"strings"
 
@@ -255,8 +256,8 @@ func processImportValues(c *chart.Chart, merge bool) error {
 		for _, riv := range r.ImportValues {
 			switch iv := riv.(type) {
 			case map[string]interface{}:
-				child := iv["child"].(string)
-				parent := iv["parent"].(string)
+				child := fmt.Sprintf("%v", iv["child"])
+				parent := fmt.Sprintf("%v", iv["parent"])
 
 				outiv = append(outiv, map[string]string{
 					"child":  child,
  • pkg/lint/rules/chartfile.go+3 −0 modified
    @@ -151,6 +151,9 @@ func validateChartVersion(cf *chart.Metadata) error {
 
 func validateChartMaintainer(cf *chart.Metadata) error {
 	for _, maintainer := range cf.Maintainers {
+		if maintainer == nil {
+			return errors.New("a maintainer entry is empty")
+		}
 		if maintainer.Name == "" {
 			return errors.New("each maintainer requires a name")
 		} else if maintainer.Email != "" && !govalidator.IsEmail(maintainer.Email) {
  • pkg/lint/rules/chartfile_test.go+10 −0 modified
    @@ -143,6 +143,16 @@ func TestValidateChartMaintainer(t *testing.T) {
 			t.Errorf("validateChartMaintainer(%s, %s) to return no error, got %s", test.Name, test.Email, err.Error())
 		}
 	}
+
+	// Testing for an empty maintainer
+	badChart.Maintainers = []*chart.Maintainer{nil}
+	err := validateChartMaintainer(badChart)
+	if err == nil {
+		t.Errorf("validateChartMaintainer did not return error for nil maintainer as expected")
+	}
+	if err.Error() != "a maintainer entry is empty" {
+		t.Errorf("validateChartMaintainer returned unexpected error for nil maintainer: %s", err.Error())
+	}
 }
 
 func TestValidateChartSources(t *testing.T) {
  • pkg/repo/index.go+1 −0 modified
    @@ -357,6 +357,7 @@ func loadIndex(data []byte, source string) (*IndexFile, error) {
 		for idx := len(cvs) - 1; idx >= 0; idx-- {
 			if cvs[idx] == nil {
 				log.Printf("skipping loading invalid entry for chart %q from %s: empty entry", name, source)
+				cvs = append(cvs[:idx], cvs[idx+1:]...)
 				continue
 			}
 			// When metadata section missing, initialize with no data
  • pkg/repo/index_test.go+1 −0 modified
    @@ -68,6 +68,7 @@ entries:
   grafana:
   - apiVersion: v2
     name: grafana
+  - null
   foo:
   -
   bar:

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.