CVE-2026-35206
MediumAdvisory
Published 10 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.8
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 17,787 indexed, latest versions
- Container images
- 210
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| helm.sh/ | v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more | 3.20.2 | 208 |
| helm.sh/ | v4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.3 | 4.1.4 | 5 |
- OSV records
- GHSA-hr2v-4r36-88hr
- Also known as
- BIT-helm-2026-35206, GO-2026-5435
Charts affected
201 by stars
Container images carrying it
210 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| logiqai/ | 65b996bc7bdc | helm.sh/ | 3.20.2 | 1 |
| mavrick1/ | 45ca0429a1d4 | helm.sh/ | 3.20.2 | 1 |
| milvusdb/ | 5d63c8894f3a | helm.sh/ | 3.20.2 | 1 |
| murtazashah46/ | 4d11726cf803 | helm.sh/ | 3.20.2 | 1 |
| newrelic/ | 1a448492b55a | helm.sh/ | 3.20.2 | 1 |
| phntom/ | 53883b65d9b7 | helm.sh/ | 3.20.2 | 1 |
| phntom/ | 9242b4df9e65 | helm.sh/ | 3.20.2 | 1 |
| pnnlmiscscripts/ | 155131891741 | helm.sh/ | 3.20.2 | 1 |
| pnnlmiscscripts/ | 8af4b7551d40 | helm.sh/ helm.sh/ | 3.20.2 4.1.4 | 1 |
| portainer/ | 3e61aaee1341 | helm.sh/ | 3.20.2 | 1 |
| replicated/ | 8751b4963250 | helm.sh/ | 3.20.2 | 1 |
| sirrend/ | 699e79e3d4e2 | helm.sh/ | 3.20.2 | 1 |
| sstarcher/ | 11769d01ba35 | helm.sh/ | 3.20.2 | 1 |
| veecode/ | c69fd286b489 | helm.sh/ | 3.20.2 | 1 |
| gcr.io/ | 8d4576f7b98f | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | fc336c5b9655 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | d6c2532ea386 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | a608b798fda5 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | cb5f24732197 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 9ab9a675c405 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 2cef2a3f97da | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | e02a8bd9e2c3 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 3ee1b62aa111 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | a058034ca006 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 8d35a64e4a99 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 091b906a0b13 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 700bb42ac21d | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 8bc853c7414c | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 9e48285bb44c | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | bdb31f3121a2 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | f059af4de8ed | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 00984ba0f0eb | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 2ce077d3d02d | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 59f75504c5d4 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | a6ae5aff81ce | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 274a179fd402 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 62eaa9c9a929 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 00cd9316a379 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 2088dcb22aaa | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 2ce23f948e02 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 4ee4b71cf16a | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | ae85d68749c7 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 07d51f838f0d | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 71d1f1c0179e | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 878ef6a31fa0 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | c298183a5208 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | c81f105c3682 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | f20e612d5a98 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 50b431281d3e | helm.sh/ helm.sh/ | 3.20.2 4.1.4 | 1 |
| ghcr.io/ | c8882543f693 | helm.sh/ | 3.20.2 | 1 |