CVE-2026-35206
MediumAdvisory
Published 10 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 4.8
- base score, highest
- EPSS
- 0.002
- 10th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 201
- of 17,787 indexed, latest versions
- Container images
- 210
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment
Carried by container images the latest versions of 201 of 17,787 indexed charts deploy, on 210 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| helm.sh/ | v0.0.0-20221012195806-9f88ccb6aee4, v0.0.0-20221214143859-835b7334cfe2, v0.0.0-20230113165805-472c5736ab01, v0.0.0-20230308205603-912ebc1cd10d+80 more | 3.20.2 | 208 |
| helm.sh/ | v4.0.0-20250324191910-0199b748aaea, v4.1.0, v4.1.3 | 4.1.4 | 5 |
- OSV records
- GHSA-hr2v-4r36-88hr
- Also known as
- BIT-helm-2026-35206, GO-2026-5435
Charts affected
201 by stars
Container images carrying it
210 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 2ad610626658 | helm.sh/ | 3.20.2 | 6 |
| keelhq/ | 73714afb4443 | helm.sh/ | 3.20.2 | 5 |
| ghcr.io/ | ab2e1fa19dd4 | helm.sh/ | 3.20.2 | 4 |
| quay.io/ | c10bde7ff9ad | helm.sh/ | 3.20.2 | 4 |
| goharbor/ | d7b780d23721 | helm.sh/ | 3.20.2 | 3 |
| goharbor/ | f71a4452a095 | helm.sh/ | 3.20.2 | 3 |
| kubegems/ | a730bcf9322a | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 6545dac92173 | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 60566529446a | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 721b5c9634d4 | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 9795f3f9f031 | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 01d5d8c4cecb | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 98580969b333 | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | 9d25865295af | helm.sh/ | 3.20.2 | 3 |
| quay.io/ | ea6dd1e4ce71 | helm.sh/ | 3.20.2 | 3 |
| alpine/ | 048f8d9c8cc7 | helm.sh/ helm.sh/ | 3.20.2 4.1.4 | 2 |
| dtzar/ | 55429449408e | helm.sh/ | 3.20.2 | 2 |
| ilum/ | 624fd09528c8 | helm.sh/ | 3.20.2 | 2 |
| k0sproject/ | f04635825d51 | helm.sh/ | 3.20.2 | 2 |
| ghcr.io/ | 1f5c791fc54d | helm.sh/ | 3.20.2 | 2 |
| ghcr.io/ | e192ad567e0b | helm.sh/ | 3.20.2 | 2 |
| ghcr.io/ | 82d0b161161d | helm.sh/ | 3.20.2 | 2 |
| ghcr.io/ | fba6fb872281 | helm.sh/ | 3.20.2 | 2 |
| quay.io/ | 5fc69e31c755 | helm.sh/ | 3.20.2 | 2 |
| quay.io/ | 74611761f052 | helm.sh/ | 3.20.2 | 2 |
| registry.gitlab.com/ | b1198ea741d1 | helm.sh/ | 3.20.2 | 2 |
| alpine/ | 105741fa6621 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 905a068da431 | helm.sh/ | 4.1.4 | 1 |
| alpine/ | 00ac10bcb759 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 21b24e6bf801 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 6dbe6f391eda | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 7a319b15cfc9 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 7e1e7d5b7a96 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | 9c4976d47656 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | a41efe02a041 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | bd01dae02676 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | cd560fce90f7 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | e5c0b053fed7 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | eec354133193 | helm.sh/ | 3.20.2 | 1 |
| alpine/ | fc059f056ad0 | helm.sh/ | 3.20.2 | 1 |
| apecloud/ | 98abc64aa985 | helm.sh/ | 3.20.2 | 1 |
| aquasec/ | 6e790e233872 | helm.sh/ | 3.20.2 | 1 |
| aquasec/ | 944a04445179 | helm.sh/ | 3.20.2 | 1 |
| aquasec/ | 973d0df16189 | helm.sh/ | 3.20.2 | 1 |
| aquasec/ | bcc376de8d77 | helm.sh/ | 3.20.2 | 1 |
| artifacthub/ | 111918d8c399 | helm.sh/ | 3.20.2 | 1 |
| artifacthub/ | 2d8365601f0e | helm.sh/ | 3.20.2 | 1 |
| artifacthub/ | 323d026e78c3 | helm.sh/ | 3.20.2 | 1 |
| artifacthub/ | 6596c8c4d955 | helm.sh/ | 3.20.2 | 1 |
| beopenit/ | d24c323fe7c3 | helm.sh/ | 3.20.2 | 1 |