StackRadarChart IndexLive demo

CVE-2021-21303

Medium

Advisory

Published 5 Feb 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.010; 62nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 13; of 17,781 indexed, latest versions
Container images: 12; deployed by those charts
Fix available: 1 of 2; affected packages

Improper Neutralization of Special Elements in Output in helm.sh/helm/v3

Carried by container images the latest versions of 13 of 17,781 indexed charts deploy, on 12 images.

Affected package	Affected versions	Fixed in	Images
helm.sh/helm/v3golang	v3.0.2, v3.0.3, v3.1.0, v3.2.0+5 more	3.5.2	11
helmdeb	3.18.1-1	no fix listed	1

OSV records: GHSA-c38g-469g-cmgx UBUNTU-CVE-2021-21303
Also known as: BIT-helm-2021-21303, GO-2022-1040

Charts affected

13 by stars

Chart

Latest

Affected images

Radar Score

helm-exportersstarcher

1 of 1 See more

helm-exporter sstarcher 0.5.0

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
sstarcher/helm-exporter :0.5.0	11769d01ba35	helm.sh/helm/v3@v3.0.2	3.5.2

Open the chart page →

4,154

helm-operatorhelm-operator

1 of 1 See more

helm-operator helm-operator 0.0.2

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
bsgrigorov/helm-operator :latest	45ab095f09c8	helm.sh/helm/v3@v3.4.1	3.5.2

Open the chart page →

6,977

mesherykubesphere-stable

1 of 13 See more

meshery kubesphere-stable 0.5.0

1 of the 13 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
layer5/meshery-nsm :stable-latest	ebd6a8faf21f	helm.sh/helm/v3@v3.3.1	3.5.2

Open the chart page →

24,690

node-appbryopsida

1 of 2 See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	helm@3.18.1-1	no fix listed

Open the chart page →

14,352

ambassador-operatordatawire

1 of 1 See more

ambassador-operator datawire 0.3.0

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
datawire/ambassador-operator :v1.3.0	f95ae710d75c	helm.sh/helm/v3@v3.0.3	3.5.2

Open the chart page →

7,486

siembolgresearch

1 of 4 See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
alpine/k8s :1.18.16	a41efe02a041	helm.sh/helm/v3@v3.5.1	3.5.2

Open the chart page →

14,312

k8s-dev-podk8s-dev-pod

1 of 1 See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	helm@3.18.1-1	no fix listed

Open the chart page →

8,811

pipecdkrzwiatrzyk

1 of 3 See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
ghcr.io/pipe-cd/pipecd :v0.39.0	0fae829caf29	helm.sh/helm/v3@v3.2.0	3.5.2

Open the chart page →

3,812

ladeitladeit

1 of 2 See more

ladeit ladeit 0.4.0

1 of the 2 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
kubeoperator/webkubectl :v2.4.0	be8f0d624640	helm.sh/helm/v3@v3.2.0	3.5.2

Open the chart page →

26,356

devspace-cloudloft

1 of 8 See more

devspace-cloud loft 0.3.3

1 of the 8 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
devspacecloud/manager :0.3.3	49c397413f7b	helm.sh/helm/v3@v3.1.0	3.5.2

Open the chart page →

9,880

gitlab-runner-operatorpnnl-miscscripts

1 of 1 See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	helm.sh/helm/v3@v3.0.2	3.5.2

Open the chart page →

11,151

quarksquarks

7.0.1+0.g5396b11

1 of 5 See more

quarks quarks 7.0.1+0.g5396b11

1 of the 5 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
ghcr.io/cloudfoundry-incubator/quarks-secret :v1.0.754	f059af4de8ed	helm.sh/helm/v3@v3.3.0	3.5.2

Open the chart page →

18,197

stackrox-chartredhat-cop

1 of 1 See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2021-21303.

Container image	Digest	Package	Fixed in
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.5.2

Open the chart page →

29,227

Container images carrying it

12 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	helm@3.18.1-1	no fix listed	2
alpine/k8s :1.18.16	a41efe02a041	helm.sh/helm/v3@v3.5.1	3.5.2	1
bsgrigorov/helm-operator :latest	45ab095f09c8	helm.sh/helm/v3@v3.4.1	3.5.2	1
datawire/ambassador-operator :v1.3.0	f95ae710d75c	helm.sh/helm/v3@v3.0.3	3.5.2	1
devspacecloud/manager :0.3.3	49c397413f7b	helm.sh/helm/v3@v3.1.0	3.5.2	1
kubeoperator/webkubectl :v2.4.0	be8f0d624640	helm.sh/helm/v3@v3.2.0	3.5.2	1
layer5/meshery-nsm :stable-latest	ebd6a8faf21f	helm.sh/helm/v3@v3.3.1	3.5.2	1
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	helm.sh/helm/v3@v3.0.2	3.5.2	1
sstarcher/helm-exporter :0.5.0	11769d01ba35	helm.sh/helm/v3@v3.0.2	3.5.2	1
ghcr.io/cloudfoundry-incubator/quarks-secret :v1.0.754	f059af4de8ed	helm.sh/helm/v3@v3.3.0	3.5.2	1
ghcr.io/pipe-cd/pipecd :v0.39.0	0fae829caf29	helm.sh/helm/v3@v3.2.0	3.5.2	1
quay.io/rht-labs/stack-do500 :3.0.8	6ba82beff18e	helm.sh/helm/v3@v3.3.4	3.5.2	1