https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T12:37:13.951637+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-helm-2020-15186 BIT-helm-2020-15186 — Improper sanitization of plugin names in Helm 2026-10-04T12:37:14.022495+00:00

Affected: Bitnami: helm

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

 https://cve.radiocsirt.org/vuln/cnvd-2020-52932 cnvd-2020-52932 2026-10-04T12:37:14.022553+00:00 cnvd-2020-52932 https://cve.radiocsirt.org/vuln/euvd-2026-42724 EUVD-2026-42724 2026-10-04T12:37:14.022571+00:00 EUVD-2026-42724 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15186 fkie_cve-2020-15186 2026-10-04T12:37:14.022584+00:00

In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

 https://cve.radiocsirt.org/vuln/ghsa-m54r-vrmv-hw33 GHSA-m54r-vrmv-hw33 — Improper Sanitizing of plugin names in helm 2026-10-04T12:37:14.022609+00:00

Affected: Go: helm.sh/helm/v3, Go: helm.sh/helm

### Impact

Security researchers at Trail of Bits discovered that plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`.

### Specific Go Packages Affected helm.sh/helm/v3/pkg/plugin

### Patches

This issue has been patched in Helm 3.3.2.

### Workarounds

Do not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.

 https://cve.radiocsirt.org/vuln/gsd-2020-15186 gsd-2020-15186 2026-10-04T12:37:14.022639+00:00 gsd-2020-15186 https://cve.radiocsirt.org/vuln/rhea-2021:0729 RHEA-2021:0729 — Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images 2026-10-04T12:37:14.022651+00:00

golang-github-buger-jsonparser: infinite loop via a Delete call node-fetch: size of data after fetch() JS thread leads to DoS helm: Chart.yaml is not properly sanitized lead to injection of unwanted information into chart helm: write access to the index file allows an attacker to inject bad chart into repository helm: plugin names are not sanitized properly helm: write access to the git repository or plugin archive causing causing a local execution attack jsonparser: GET call can lead to a slice bounds out of range redisgraph: NULL pointer dereference because it mishandles an unquoted string

 https://cve.radiocsirt.org/vuln/suse-su-2020:3760-1 SUSE-SU-2020:3760-1 — Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package 2026-10-04T12:37:14.022675+00:00

Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package