Nixpkgs security tracker
Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install
Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.
References
-
https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 x_refsource_CONFIRM
-
https://github.com/helm/helm/releases/tag/v4.1.4 x_refsource_MISC
-
https://helm.sh/docs/topics/provenance/#the-provenance-file x_refsource_MISC
Affected products
- ==>= 4.0.0, < 4.1.4
Matching in nixpkgs
pkgs.helm
Free, cross-platform, polyphonic synthesizer
pkgs.helm-ls
Language server for Helm
pkgs.helmfile
Declarative spec for deploying Helm charts
pkgs.helmsman
Helm Charts (k8s applications) as Code tool
pkgs.helm-docs
Tool for automatically generating markdown documentation for Helm charts
pkgs.helmholtz
Time domain pitch tracker for Pure Data
pkgs.helm-dashboard
Simplified way of working with Helm
pkgs.kubernetes-helm
Package manager for kubernetes
pkgs.helmfile-wrapped
Declarative spec for deploying Helm charts
pkgs.terraform-providers.helm
None
pkgs.kubernetes-helmPlugins.helm-dt
Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier
pkgs.kubernetes-helmPlugins.helm-s3
Helm plugin that allows to set up a chart repository using AWS S3
pkgs.kubernetes-helmPlugins.helm-git
Helm downloader plugin that provides GIT protocol support
pkgs.kubernetes-helmPlugins.helm-diff
Helm plugin that shows a diff
pkgs.kubernetes-helmPlugins.helm-schema
Helm plugin for generating values.schema.json from multiple values files
pkgs.terraform-providers.hashicorp_helm
None
pkgs.kubernetes-helmPlugins.helm-cm-push
Helm plugin to push chart package to ChartMuseum
pkgs.kubernetes-helmPlugins.helm-secrets
Helm plugin that helps manage secrets
pkgs.kubernetes-helmPlugins.helm-unittest
BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin
pkgs.kubernetes-helmPlugins.helm-mapkubeapis
Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs
pkgs.vimPlugins.nvim-treesitter-parsers.helm
None
-
nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63
pkgs.vscode-extensions.tim-koehler.helm-intellisense
Extension to help writing Helm-Templates by providing intellisense
pkgs.tree-sitter-grammars.tree-sitter-go-template-helm
Tree-sitter grammar for go-template-helm
-
nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm
Python bindings for tree-sitter-go-template-helm
-
nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
Package maintainers
-
@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
-
@magnetophon Bart Brouns <bart@magnetophon.nl>
-
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
-
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
-
@stehessel Stephan Heßelmann <stephan@stehessel.de>
-
@kliu128 Kevin Liu <kevin@potatofrom.space>
-
@yurrriq Eric Bailey <eric@ericb.me>
-
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
-
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
-
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
-
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
-
@Frostman Sergei Lukianov <me@slukjanov.name>
-
@edude03 Michael Francis <michael@melenion.com>
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
-
@a1994sc Allen Conlon <software@conlon.dev>
-
@flokli Florian Klink <flokli@flokli.de>
-
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@azahi Azat Bahawi <azat@bahawi.net>