MEDIUMGo
GHSA-hr2v-4r36-88hr· BIT-helm-2026-35206, CVE-2026-35206Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Modified: 9/10/2026
package
Go/helm.sh/helm/v4
pkg:go/helm.sh/helm/v4
HIGH7.8Go
GHSA-q5jf-9vfq-h4h7· BIT-helm-2026-35205, CVE-2026-35205Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Modified: 9/10/2026
HIGH8.6Go
GHSA-vmx8-mqv2-9gmg· BIT-helm-2026-35204, CVE-2026-35204Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Modified: 9/10/2026
—Go
GO-2026-5566· BIT-helm-2026-35205, CVE-2026-35205Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install in helm.sh/helm
Modified: 7/24/2026
—Go
GO-2026-5666· BIT-helm-2026-35204, CVE-2026-35204Helm path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory in helm.sh/helm
Modified: 7/24/2026