CVE-2019-18658: Helm Unsafe Link Following
Summary
CVE-2019-18658: Helm Unsafe Link Following. Affects helm.sh/helm versions >= 2.0.0, < 2.15.2. Fixed in 2.15.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Helm is a package manager for Kubernetes that simplifies the deployment and management of applications. It allows users to define, install, and upgrade complex Kubernetes applications using charts. Helm 2.x versions prior to 2.15.2 are affected by a vulnerability that allows a specially crafted chart to include sensitive content or execute a denial of service attack. This vulnerability only affects the client-side of Helm, and no version of Tiller is known to be impacted.
Vulnerability Detail
The vulnerability in Helm 2.x versions before 2.15.2 arises from commands that handle loading a chart as a directory or packaging a chart. A maliciously designed chart can exploit this vulnerability to include sensitive files like /etc/passwd or execute a denial of service attack using special files like /dev/urandom through the use of symlinks. The impact of this vulnerability can lead to unauthorized access to sensitive information or disruption of service.
How To Fix
Latest published version: v2.17.0+incompatible as of 22 Oct 2026
go get helm.sh/helm@v2.17.0+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.15.2
This is the first release that contains the fix.
go get helm.sh/helm@v2.15.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Helm to address the issue.
Conclusion
The Helm Unsafe Link Following vulnerability in versions before 2.15.2 can allow an attacker to include sensitive content or execute a denial of service attack. It is crucial to upgrade to the fixed version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for helm.sh/helm →
FAQ
Helm is a package manager for Kubernetes that simplifies the deployment and management of applications.
Helm 2.x versions before 2.15.2 are affected by this vulnerability.
No, no version of Tiller is known to be impacted by this vulnerability. Only the client-side of Helm is affected.
An attacker can include sensitive files or execute a denial of service attack by exploiting this vulnerability.
To fix this vulnerability, upgrade to Helm version 2.15.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for helm.sh/helm.
