helm.sh/helm/v4 vulnerabilities
CVEs whose affected-version data names the helm.sh/helm/v4 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-35204High· 8.6PoCHelm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
▾ Midnighthelm · helm.sh/helm/v4EPSS 0.20%via OSV
CVE-2026-35205High· 7.8Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
▾ Twilighthelm · helm.sh/helm/v4EPSS 0.22%via OSV
CVE-2026-35206MediumHelm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
▾ Sunlithelm · helm.sh/helm/v4EPSS 0.20%via OSV