CVE-2026-35206

Name of the Vulnerable Software and Affected Versions Helm versions 3.20.1 and earlier, and versions 4.1.3 and earlier

Description Helm, a package manager for Kubernetes Charts, is affected by an issue where a specially crafted Chart can cause the helm pull --untar command to write chart contents to an incorrect directory. Specifically, the command writes to the current working directory (or directories specified by the --destination and --untardir flags) instead of the expected chart-name-suffixed output directory. This occurs when processing a malicious chart via the helm pull --untar command.

Recommendations Update to Helm version 3.20.2 or later. Update to Helm version 4.1.4 or later.