Nixpkgs security tracker
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.
References
-
https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr x_refsource_CONFIRM
-
https://github.com/helm/helm/releases/tag/v4.1.4 x_refsource_MISC
Affected products
- ==>= 4.0.0, < 4.1.4
- ==< 3.20.2
Matching in nixpkgs
pkgs.helm
Free, cross-platform, polyphonic synthesizer
pkgs.helm-ls
Language server for Helm
pkgs.helmfile
Declarative spec for deploying Helm charts
pkgs.helmsman
Helm Charts (k8s applications) as Code tool
pkgs.helm-docs
Tool for automatically generating markdown documentation for Helm charts
pkgs.helmholtz
Time domain pitch tracker for Pure Data
pkgs.helm-dashboard
Simplified way of working with Helm
pkgs.kubernetes-helm
Package manager for kubernetes
pkgs.helmfile-wrapped
Declarative spec for deploying Helm charts
pkgs.terraform-providers.helm
None
pkgs.kubernetes-helmPlugins.helm-dt
Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier
pkgs.kubernetes-helmPlugins.helm-s3
Helm plugin that allows to set up a chart repository using AWS S3
pkgs.kubernetes-helmPlugins.helm-git
Helm downloader plugin that provides GIT protocol support
pkgs.kubernetes-helmPlugins.helm-diff
Helm plugin that shows a diff
pkgs.kubernetes-helmPlugins.helm-schema
Helm plugin for generating values.schema.json from multiple values files
pkgs.terraform-providers.hashicorp_helm
None
pkgs.kubernetes-helmPlugins.helm-cm-push
Helm plugin to push chart package to ChartMuseum
pkgs.kubernetes-helmPlugins.helm-secrets
Helm plugin that helps manage secrets
pkgs.kubernetes-helmPlugins.helm-unittest
BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin
pkgs.kubernetes-helmPlugins.helm-mapkubeapis
Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs
pkgs.vimPlugins.nvim-treesitter-parsers.helm
None
-
nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63
pkgs.vscode-extensions.tim-koehler.helm-intellisense
Extension to help writing Helm-Templates by providing intellisense
pkgs.tree-sitter-grammars.tree-sitter-go-template-helm
Tree-sitter grammar for go-template-helm
-
nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
Package maintainers
-
@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
-
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
-
@stehessel Stephan Heßelmann <stephan@stehessel.de>
-
@kliu128 Kevin Liu <kevin@potatofrom.space>
-
@yurrriq Eric Bailey <eric@ericb.me>
-
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
-
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
-
@Frostman Sergei Lukianov <me@slukjanov.name>
-
@edude03 Michael Francis <michael@melenion.com>
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
-
@a1994sc Allen Conlon <software@conlon.dev>
-
@flokli Florian Klink <flokli@flokli.de>
-
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@azahi Azat Bahawi <azat@bahawi.net>