Nixpkgs security tracker
Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not include a version: field containing POSIX dot-dot path separators ie. "/../". This vulnerability is fixed in 4.1.4.
References
-
https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg x_refsource_CONFIRM
-
https://github.com/helm/helm/releases/tag/v4.1.4 x_refsource_MISC
Affected products
- ==>= 4.0.0, < 4.1.4
Matching in nixpkgs
pkgs.helm
Free, cross-platform, polyphonic synthesizer
pkgs.helm-ls
Language server for Helm
pkgs.helmfile
Declarative spec for deploying Helm charts
pkgs.helmsman
Helm Charts (k8s applications) as Code tool
pkgs.helm-docs
Tool for automatically generating markdown documentation for Helm charts
pkgs.helmholtz
Time domain pitch tracker for Pure Data
pkgs.helm-dashboard
Simplified way of working with Helm
pkgs.kubernetes-helm
Package manager for kubernetes
pkgs.helmfile-wrapped
Declarative spec for deploying Helm charts
pkgs.terraform-providers.helm
None
pkgs.kubernetes-helmPlugins.helm-dt
Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier
pkgs.kubernetes-helmPlugins.helm-s3
Helm plugin that allows to set up a chart repository using AWS S3
pkgs.kubernetes-helmPlugins.helm-git
Helm downloader plugin that provides GIT protocol support
pkgs.kubernetes-helmPlugins.helm-diff
Helm plugin that shows a diff
pkgs.kubernetes-helmPlugins.helm-schema
Helm plugin for generating values.schema.json from multiple values files
pkgs.terraform-providers.hashicorp_helm
None
pkgs.kubernetes-helmPlugins.helm-cm-push
Helm plugin to push chart package to ChartMuseum
pkgs.kubernetes-helmPlugins.helm-secrets
Helm plugin that helps manage secrets
pkgs.kubernetes-helmPlugins.helm-unittest
BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin
pkgs.kubernetes-helmPlugins.helm-mapkubeapis
Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs
pkgs.vimPlugins.nvim-treesitter-parsers.helm
None
-
nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63
pkgs.vscode-extensions.tim-koehler.helm-intellisense
Extension to help writing Helm-Templates by providing intellisense
pkgs.tree-sitter-grammars.tree-sitter-go-template-helm
Tree-sitter grammar for go-template-helm
-
nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
Package maintainers
-
@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
-
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
-
@stehessel Stephan Heßelmann <stephan@stehessel.de>
-
@kliu128 Kevin Liu <kevin@potatofrom.space>
-
@yurrriq Eric Bailey <eric@ericb.me>
-
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
-
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
-
@Frostman Sergei Lukianov <me@slukjanov.name>
-
@edude03 Michael Francis <michael@melenion.com>
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
-
@a1994sc Allen Conlon <software@conlon.dev>
-
@flokli Florian Klink <flokli@flokli.de>
-
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@azahi Azat Bahawi <azat@bahawi.net>