CVE-2026-35206
MediumAdvisory
Published 10 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.8
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 17,787 indexed, latest versions
- Container images
- 210
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| helm.sh/ | v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more | 3.20.2 | 208 |
| helm.sh/ | v4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.3 | 4.1.4 | 5 |
- OSV records
- GHSA-hr2v-4r36-88hr
- Also known as
- BIT-helm-2026-35206, GO-2026-5435
Charts affected
201 by stars
Container images carrying it
210 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 315e188a07c2 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | b40439329191 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 27a5c64b7ea8 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | a7fce69e171c | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 3475404bef5c | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 3acba3df8827 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 365183f83ac9 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | fc256885915b | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 6de40f528be9 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 0cbced8e6240 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | f52e66eff50b | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | a7e922ddac55 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | e93dfe7454d4 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | cce8ff866f60 | helm.sh/ | 4.1.4 | 1 |
| ghcr.io/ | b5ade0d9cc6b | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 5c109914ff73 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 5dfa86b6451f | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 90097a08b87c | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | b69bcdaa8492 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 84f70425f4dd | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 45e744fc623f | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | df917c5a7e54 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 7fbc6855c8b3 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 5bc5ca66d55a | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | d7f93d2182fe | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | c0c8d53df9f3 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 0fae829caf29 | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 62370545ba3d | helm.sh/ | 3.20.2 | 1 |
| ghcr.io/ | 9d01bf9c9224 | helm.sh/ | 3.20.2 | 1 |
| public.ecr.aws/ | 1eb61443d68e | helm.sh/ | 3.20.2 | 1 |
| public.ecr.aws/ | 01d8413d5075 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 95b5cf7ba6fe | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | a36ab0c0860c | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | acaf37352569 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 14b482c1f1b8 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 13aaae779248 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 3590af73f65a | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | b741efae8d31 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 4d9fce2c050e | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 595c548dee6f | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 81b2d775edad | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 8d54fe9d0c0d | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | ebba936046ab | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 150f76e844d9 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | edb322094359 | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 65a38180e27a | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 35f9c3ad644a | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 7e571a08ec1a | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | d6284bd7765a | helm.sh/ | 3.20.2 | 1 |
| quay.io/ | 3e010e1188f1 | helm.sh/ | 3.20.2 | 1 |