CVE-2025-53547

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.18.4

Description: A specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file can be crafted to cause execution if the content were in a file that is executed, such as a bash.rc file or shell script. If the Chart.lock file is symlinked to one of these files, updating dependencies will write the lock file content to the symlinked file, leading to unwanted execution. This issue affects when dependencies are updated, for example, when helm dependency update is run.

Recommendations: For Helm versions prior to 3.18.4, ensure the Chart.lock file in a chart is not a symlink prior to updating dependencies. Update to Helm v3.18.4 to resolve the issue.