CVE-2025-53547

High

Advisory

Published 8 Jul 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.5; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 156; of 17,781 indexed, latest versions
Container images: 160; deployed by those charts
Fix available: 1 of 1; affected package

Helm vulnerable to Code Injection through malicious chart.yaml content

Carried by container images the latest versions of 156 of 17,781 indexed charts deploy, on 160 images.

Affected package	Affected versions	Fixed in	Images
helm.sh/helm/v3golang	v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+68 more	3.17.4, 3.18.4	160

OSV records: GHSA-557j-xg8c-q2mm
Also known as: BIT-helm-2025-53547, GO-2025-3802

Charts affected

156 by stars

Chart

Latest

Affected images

Radar Score

harborsoftonic

1.13.0

3 of 8 See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.9.0	6412d679fdc3	helm.sh/helm/v3@v3.11.3	3.17.4
goharbor/harbor-jobservice :v2.9.0	39435daedd0c	helm.sh/helm/v3@v3.11.3	3.17.4
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	helm.sh/helm/v3@v3.12.1	3.17.4

Open the chart page →

7,672

trivy-operatorsoftonic

0.18.0

1 of 1 See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
ghcr.io/aquasecurity/trivy-operator :0.16.0	a608b798fda5	helm.sh/helm/v3@v3.12.1	3.17.4

Open the chart page →

2,505

switchbladeswitchblade

0.0.19

1 of 1 See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
public.ecr.aws/boundless-software/switchblade :release-v0.0.19-lcm	01d8413d5075	helm.sh/helm/v3@v3.14.3	3.17.4

Open the chart page →

1,360

harbor-scanner-trivytrivy-operator

0.31.2

1 of 1 See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	helm.sh/helm/v3@v3.14.2	3.17.4

Open the chart page →

2,477

istio-service-meshwbstack

0.0.1

1 of 1 See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
istio/pilot :1.17.1	ce9d87606701	helm.sh/helm/v3@v3.11.0	3.17.4

Open the chart page →

6,232

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-53547.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.17.4

Open the chart page →

13,677

Container images carrying it

160 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/kubectl :latest	2ad610626658	helm.sh/helm/v3@v0.0.0-20221012195806-9f88ccb6aee4	3.17.4	6
keelhq/keel :latest	73714afb4443	helm.sh/helm/v3@v3.13.1	3.17.4	5
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	helm.sh/helm/v3@v0.0.0-20230113165805-472c5736ab01	3.17.4	4
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	helm.sh/helm/v3@v3.12.3	3.17.4	4
quay.io/devtron/ai-agent :0.0.1	6545dac92173	helm.sh/helm/v3@v3.15.2	3.17.4	3
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	helm.sh/helm/v3@v3.12.3	3.17.4	3
dtzar/helm-kubectl :3.14.4	55429449408e	helm.sh/helm/v3@v0.0.0-20240410185915-81c902a12346	3.17.4	2
ilum/api :6.7.3	624fd09528c8	helm.sh/helm/v3@v0.0.0-20250409171524-e4da49785aa6	3.17.4	2
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	helm.sh/helm/v3@v3.10.3	3.17.4	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	helm.sh/helm/v3@v0.0.0-20250527180604-f6f8700a539c	3.17.4	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	helm.sh/helm/v3@v0.0.0-20241111191401-cfd07493f46e	3.17.4	2
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	helm.sh/helm/v3@v3.10.3	3.17.4	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	helm.sh/helm/v3@v0.0.0-20251211174049-7cfb6e486dac	3.17.4	2
alpine/helm	105741fa6621	helm.sh/helm/v3@v0.0.0-20240814142712-fa9efb07d9d8	3.17.4	1
alpine/k8s :1.22.6	00ac10bcb759	helm.sh/helm/v3@v3.7.1	3.17.4	1
alpine/k8s :1.27.3	21b24e6bf801	helm.sh/helm/v3@v3.11.3	3.17.4	1
alpine/k8s :1.31.10	6dbe6f391eda	helm.sh/helm/v3@v3.18.2	3.18.4	1
alpine/k8s :1.31.13	7a319b15cfc9	helm.sh/helm/v3@v0.0.0-20250905035149-3d8990f08366	3.17.4	1
alpine/k8s :1.32.4	7e1e7d5b7a96	helm.sh/helm/v3@v3.17.2	3.17.4	1
alpine/k8s :1.31.4	9c4976d47656	helm.sh/helm/v3@v3.14.3	3.17.4	1
alpine/k8s :1.18.16	a41efe02a041	helm.sh/helm/v3@v3.5.1	3.17.4	1
alpine/k8s :1.30.0	bd01dae02676	helm.sh/helm/v3@v3.14.2	3.17.4	1
alpine/k8s :1.30.2	cd560fce90f7	helm.sh/helm/v3@v3.14.4	3.17.4	1
alpine/k8s :1.28.13	e5c0b053fed7	helm.sh/helm/v3@v3.11.2	3.17.4	1
alpine/k8s :1.32.3	eec354133193	helm.sh/helm/v3@v3.17.1	3.17.4	1
alpine/k8s :1.28.2	fc059f056ad0	helm.sh/helm/v3@v0.0.0-20230918200057-825e86f6a7a3	3.17.4	1
apecloud/kb-cloud-installer :v2.1.42-certified	98abc64aa985	helm.sh/helm/v3@v0.0.0-20240221201614-c309b6f0ff63	3.17.4	1
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	helm.sh/helm/v3@v3.14.2	3.17.4	1
aquasec/trivy :0.43.1	944a04445179	helm.sh/helm/v3@v3.12.1	3.17.4	1
aquasec/trivy :0.32.0	973d0df16189	helm.sh/helm/v3@v3.9.3	3.17.4	1
artifacthub/hub :v1.19.0	111918d8c399	helm.sh/helm/v3@v3.15.2	3.17.4	1
artifacthub/scanner :v1.19.0	323d026e78c3	helm.sh/helm/v3@v3.14.2	3.17.4	1
artifacthub/tracker :v1.19.0	6596c8c4d955	helm.sh/helm/v3@v3.15.2	3.17.4	1
beopenit/door-agent :v3.0.5	d24c323fe7c3	helm.sh/helm/v3@v3.15.4	3.17.4	1
beopenit/door-helm :v3.0.1	b4d9f9bee224	helm.sh/helm/v3@v3.11.3	3.17.4	1
bsgrigorov/helm-operator :latest	45ab095f09c8	helm.sh/helm/v3@v3.4.1	3.17.4	1
datawire/ambassador-operator :v1.3.0	f95ae710d75c	helm.sh/helm/v3@v3.0.3	3.17.4	1
devopstales/trivy-operator :2.5	75136aa7a26e	helm.sh/helm/v3@v3.10.3	3.17.4	1
devspacecloud/manager :0.3.3	49c397413f7b	helm.sh/helm/v3@v3.1.0	3.17.4	1
dtzar/helm-kubectl :3.11.2	a1041bb0f1d1	helm.sh/helm/v3@v0.0.0-20230308205603-912ebc1cd10d	3.17.4	1
epamedp/edp-headlamp :0.25.0	93417e18bb1a	helm.sh/helm/v3@v3.14.2	3.17.4	1
flanksource/batch-runner :v1.0.44	689687a7cf95	helm.sh/helm/v3@v3.17.3	3.17.4	1
flomesh/fsm-manager :0.2.11	22f849c70b25	helm.sh/helm/v3@v3.11.1	3.17.4	1
fluxcd/helm-controller :v0.9.0	92b891e495d8	helm.sh/helm/v3@v3.5.3	3.17.4	1
fluxcd/source-controller :v0.10.0	31a8c79a6803	helm.sh/helm/v3@v3.5.3	3.17.4	1
goharbor/chartmuseum-photon :v2.5.3	6ab3ca28e9e5	helm.sh/helm/v3@v3.8.0	3.17.4	1
goharbor/harbor-core :v2.9.0	6412d679fdc3	helm.sh/helm/v3@v3.11.3	3.17.4	1
goharbor/harbor-core :v2.5.3	86bf3031f4a7	helm.sh/helm/v3@v3.7.1	3.17.4	1
goharbor/harbor-core :v2.11.1	c017dd84ee96	helm.sh/helm/v3@v3.14.4	3.17.4	1
goharbor/harbor-jobservice :v2.9.0	39435daedd0c	helm.sh/helm/v3@v3.11.3	3.17.4	1