StackRadar

CVE-2025-53547

High

Advisory

Published 8 Jul 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.5
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
156
of 17,781 indexed, latest versions
Container images
160
deployed by those charts
Fix available
1 of 1
affected package

Helm vulnerable to Code Injection through malicious chart.yaml content

Carried by container images the latest versions of 156 of 17,781 indexed charts deploy, on 160 images.

Affected packageAffected versionsFixed inImages
helm.sh/helm/v3golangv0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+68 more3.17.4, 3.18.4160
OSV records
GHSA-557j-xg8c-q2mm
Also known as
BIT-helm-2025-53547, GO-2025-3802

Charts affected

156 by stars
ChartLatestAffected imagesRadar Score
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
helm.sh/helm/v3@v3.11.3
3.17.4
goharbor/harbor-jobservice:v2.9.039435daedd0c
helm.sh/helm/v3@v3.11.3
3.17.4
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
helm.sh/helm/v3@v3.12.1
3.17.4

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
helm.sh/helm/v3@v3.12.1
3.17.4

Open the chart page →

2,505
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
helm.sh/helm/v3@v3.14.3
3.17.4

Open the chart page →

1,360
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
helm.sh/helm/v3@v3.14.2
3.17.4

Open the chart page →

2,477
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
helm.sh/helm/v3@v3.11.0
3.17.4

Open the chart page →

6,232
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-53547.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.17.4

Open the chart page →

13,677

Container images carrying it

160 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
helm.sh/helm/v3@v3.9.4
3.17.4
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
helm.sh/helm/v3@v3.13.3
3.17.4
1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
helm.sh/helm/v3@v3.3.0
3.17.4
1
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
helm.sh/helm/v3@v0.0.0-20251111020852-4f953c223ba2
3.17.4
1
ghcr.io/clusternet/clusternet-controller-manager:v1.0.02ce077d3d02d
helm.sh/helm/v3@v3.15.2
3.17.4
1
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
helm.sh/helm/v3@v3.15.2
3.17.4
1
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
helm.sh/helm/v3@v3.15.2
3.17.4
1
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
helm.sh/helm/v3@v3.17.0
3.17.4
1
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
helm.sh/helm/v3@v3.17.1
3.17.4
1
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
helm.sh/helm/v3@v3.17.0
3.17.4
1
ghcr.io/helm/chartmuseum:v0.16.071d1f1c0179e
helm.sh/helm/v3@v3.12.0
3.17.4
1
ghcr.io/helm/chartmuseum:v0.15.0c298183a5208
helm.sh/helm/v3@v3.9.0
3.17.4
1
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
helm.sh/helm/v3@v3.17.3
3.17.4
1
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
helm.sh/helm/v3@v3.18.1
3.18.4
1
ghcr.io/kagent-dev/kagent/tools:0.0.13c8882543f693
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.17.4
1
ghcr.io/keel-hq/keel:0.22.3315e188a07c2
helm.sh/helm/v3@v3.13.1
3.17.4
1
ghcr.io/kgma74/dockyard:0.4.0b40439329191
helm.sh/helm/v3@v3.16.1
3.17.4
1
ghcr.io/kluster-manager/cluster-proxy:latest27a5c64b7ea8
helm.sh/helm/v3@v3.11.1
3.17.4
1
ghcr.io/kluster-manager/fluxcd-addon:v0.0.23acba3df8827
helm.sh/helm/v3@v3.14.3
3.17.4
1
ghcr.io/kluster-manager/managed-serviceaccount:latest365183f83ac9
helm.sh/helm/v3@v3.11.1
3.17.4
1
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
helm.sh/helm/v3@v3.14.1
3.17.4
1
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
helm.sh/helm/v3@v0.0.0-20221214143859-835b7334cfe2
3.17.4
1
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
helm.sh/helm/v3@v0.0.0-20241216182912-7877b45b63f9
3.17.4
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.17.4
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21
3.17.4
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366
3.17.4
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01
3.17.4
1
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
helm.sh/helm/v3@v0.0.0-20231012132431-3547a4b5bf5e
3.17.4
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
helm.sh/helm/v3@v0.0.0-20240205060548-90a52fb06c21
3.17.4
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
helm.sh/helm/v3@v3.13.0
3.17.4
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
helm.sh/helm/v3@v3.15.3
3.17.4
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
helm.sh/helm/v3@v3.14.2
3.17.4
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
helm.sh/helm/v3@v3.14.2
3.17.4
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
helm.sh/helm/v3@v3.14.2
3.17.4
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
helm.sh/helm/v3@v3.2.0
3.17.4
1
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
helm.sh/helm/v3@v3.10.3
3.17.4
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
helm.sh/helm/v3@v3.14.2
3.17.4
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
helm.sh/helm/v3@v3.13.1
3.17.4
1
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
helm.sh/helm/v3@v3.14.3
3.17.4
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
helm.sh/helm/v3@v0.0.0-20250212201646-980d8ac1939e
3.17.4
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
helm.sh/helm/v3@v0.0.0-20250708195800-d80839cf37d8
3.17.4
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
helm.sh/helm/v3@v0.0.0-20230614175909-f32a527a0601
3.17.4
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
helm.sh/helm/v3@v3.8.2
3.17.4
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
helm.sh/helm/v3@v3.11.1
3.17.4
1
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
helm.sh/helm/v3@v3.7.1
3.17.4
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6
3.17.4
1
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
helm.sh/helm/v3@v3.12.3
3.17.4
1
quay.io/jetstack/cert-manager-ctl:v1.8.0595c548dee6f
helm.sh/helm/v3@v3.8.1
3.17.4
1
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
helm.sh/helm/v3@v3.8.1
3.17.4
1
quay.io/jetstack/cert-manager-ctl:v1.12.08d54fe9d0c0d
helm.sh/helm/v3@v3.12.0
3.17.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.