CVE-2020-15184: Helm

Low severity, CVSS 2.7. EPSS: 1% chance of exploitation in the next 30 days.

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Affected products

• Helm Helm: from 2.0.0, before 2.16.11 (fixed in 2.16.11); from 3.0.0, before 3.3.2 (fixed in 3.3.2)

Published 2020-09-17. Last modified 2026-06-17.