CVE-2024-26147

Name of the Vulnerable Software and Affected Versions Helm versions prior to 3.14.2

Description The issue is related to an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. This can cause a panic in Helm when either an index.yaml file or a plugin's plugin.yaml file is missing all metadata. The vulnerability is found in the Helm SDK when using the LoadIndexFile or DownloadIndexFile functions in the repo package or the LoadDir function in the plugin package. For the Helm client, this impacts functions around adding a repository and all Helm functions if a malicious plugin is added.

Recommendations If using Helm versions prior to 3.14.2, update to Helm v3.14.2 to resolve the issue. If a malicious plugin has been added and is causing all Helm client commands to panic, manually remove the malicious plugin from the filesystem. For Helm SDK versions prior to 3.14.2, calls to affected functions can use recover to catch the panic.