CVSS 3.1
2.7 lowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:NCVE-2020-15186
Low (2.7) in helm helm. EPSS 1.0% chance of exploitation in the next 30 days. Fixed in helm.sh/helm/v3 3.3.2.
In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-74, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- helm:helm
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m54r-vrmv-hw33 | Go | helm.sh/helm/v3 | >=3.0.0 <3.3.2 | 3.3.2 |
| GHSA-m54r-vrmv-hw33 | Go | helm.sh/helm | <2.16.11 | 2.16.11 |