CVE-2020-15184: Helm - Unchecked Aliases in Chart.yaml
Summary
CVE-2020-15184: Aliases are never checked in helm. Affects helm.sh/helm/v3 versions >= 3.0.0, < 3.3.2. Fixed in 3.3.2. How to fix ↓
Also tracked for
- helm · Bitnami
The same CVE-2020-15184 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Helm is a popular package manager for Kubernetes that simplifies the deployment and management of applications. It uses charts, which are packages of pre-configured Kubernetes resources, to define and install applications. The Chart.yaml file is an essential component of a Helm chart as it contains metadata and configuration details. However, a vulnerability has been discovered in Helm's handling of aliases in the Chart.yaml file, which could allow the injection of unwanted information into a chart.
Vulnerability Detail
The vulnerability arises from a lack of proper sanitization of the alias field in the Chart.yaml file. This means that an attacker could manipulate the alias field to inject malicious content, such as newlines or path characters. If a chart with a manipulated alias field is installed, it could lead to unexpected behavior or compromise the security of the system. The impact of this vulnerability is considered low, but it is still important to address it to ensure the integrity of Helm charts.
How To Fix
Latest published version: v3.22.1 as of 22 Oct 2026
go get helm.sh/helm/v3@v3.22.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.2
This is the first release that contains the fix.
go get helm.sh/helm/v3@v3.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Helm is not immediately feasible, it is essential to manually review the dependencies field of any untrusted chart. Verify that the alias field is either not used or, if used, does not contain newlines or path characters. By carefully inspecting the Chart.yaml file, you can mitigate the risk of injecting unwanted information into a chart.
Conclusion
The vulnerability in Helm's handling of aliases in the Chart.yaml file can be addressed by updating Helm to the latest version. It is crucial to regularly update Helm and review the dependencies field of charts to ensure the integrity and security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for helm.sh/helm/v3 →
FAQ
Helm is a package manager for Kubernetes that simplifies the deployment and management of applications. It uses charts, which are packages of pre-configured Kubernetes resources, to define and install applications.
The Chart.yaml file is an essential component of a Helm chart. It contains metadata and configuration details for the chart, such as the chart name, version, and dependencies.
The impact of this vulnerability is considered low. However, if a chart with a manipulated alias field is installed, it could lead to unexpected behavior or compromise the security of the system.
To fix this vulnerability, update Helm to version 3.3.2 or 2.16.11, which include the necessary patches. Regularly updating Helm to the latest version is recommended to benefit from the latest security fixes and improvements.
If updating Helm is not immediately feasible, manually review the dependencies field of any untrusted chart. Verify that the alias field is either not used or, if used, does not contain newlines or path characters.
References
Related vulnerabilities
Recent vulnerabilities recorded for helm.sh/helm/v3.
