CVE-2020-15184 Aliases are never checked in Helm

What is CVE-2020-15184?

CVE-2020-15184 is a low-severity vulnerability in helm, published on 17 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.

Weakness: CWE-74, CWE-20

Which versions are affected by CVE-2020-15184?

5 open source packages ship an affected version, including helm.sh/helm, helm and helm.sh/helm/v3. It affects 1 product.

Products include Helm Helm.

How do I fix CVE-2020-15184?

Upgrade helm.sh/helm to 2.16.11 or later.

Is CVE-2020-15184 being exploited?

There is no known exploitation of CVE-2020-15184 in the wild and no public exploit code.

Other vulnerabilities in helm

• CVE-2019-18658 Helm Unsafe Link Following Critical 9.8
• CVE-2019-1010275 Helm Improper Certificate Validation Critical 9.8
• CVE-2019-25210 Information disclosure in n/a Critical 9.1
• CVE-2025-53547 Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution High 8.5
• CVE-2020-11013 lookup Function Information Discolosure in Helm High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-helm-2020-15184, GHSA-9vp5-m38w-j776.