TI-2020-11956 Aliases CVE-2020-15184 GHSA-9vp5-m38w-j776

Aliases are never checked in Helm

LOW 20CWE-20Published 2020-09-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Why it matters now

EPSS 0.01029 63rd percentileScored 2026-11-07

Fix Partial helm (helm): 2.16.11, 3.3.2helm.sh/helm/v3 (Go): 3.3.2+1 more productRed Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
helm	helm	2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2	2.16.11, 3.3.2	Patch available	CNA
—	helm.sh/helm/v3 (Go)	3.0.0 to before 3.3.2	3.3.2	Patch available	GHSA-9vp5-m38w-j776
—	helm.sh/helm (Go)	before 2.16.11	2.16.11	Patch available	GHSA-9vp5-m38w-j776

helm Vendorhelm Affected 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 Fixed in 2.16.11, 3.3.2 Patch available CNA
helm.sh/helm/v3 (Go) Vendor— Affected 3.0.0 to before 3.3.2 Fixed in 3.3.2 Patch available GHSA-9vp5-m38w-j776
helm.sh/helm (Go) Vendor— Affected before 2.16.11 Fixed in 2.16.11 Patch available GHSA-9vp5-m38w-j776

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:helm:helm::::::::	2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2	Vulnerable	helm

cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.16.11; 3.0.0 to before 3.3.2 Vulnerable ·helm

Remediation

Fix · CNA helm (helm) Fixed in 2.16.11, 3.3.2
Fix · GHSA-9vp5-m38w-j776 helm.sh/helm/v3 (Go) Fixed in 3.3.2 Advisory →
Fix · GHSA-9vp5-m38w-j776 helm.sh/helm (Go) Fixed in 2.16.11 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Advanced Cluster Management for Kubernetes 2	Affected	No fix yet

Not affected: 1 product

Red Hat OpenStack Platform 16.2

Timeline

2026-10-02 Threatist record created from CVE-2020-15184
2026-10-03 Alias added: GHSA-9vp5-m38w-j776

References

Patch 1

https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850

Advisory 2

Other 2

TI-2024-16848 Dependency management path traversal in helm CVSS 3.1MEDIUM 6.4
TI-2026-45154 Helm Files.Lines Denial of Service via Empty Chart Files CVSS 4.0MEDIUM 5.3
TI-2023-10627 getHostByName Function Information Disclosure CVSS 3.1MEDIUM 4.3
TI-2019-15264 An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. CVSS 3.1CRITICAL 9.1
TI-2019-13497 In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or… CVSS 3.1CRITICAL 9.8
TI-2019-16052 Improper certificate validation in helm CVSS 3.0CRITICAL 9.8

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences