Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4190-1 advisory.

    - Update to version 3.19.1
    - CVE-2025-53547: Fixed local code execution in Helm Chart. (bsc#1246152)
    - CVE-2025-58190: Fixed excessive memory consumption by `html.ParseFragment` when processing specially     crafted input. (bsc#1251649)
    - CVE-2025-47911: Fixed various algorithms with quadratic complexity when parsing HTML documents.
    (bsc#1251442)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of helm installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53547 advisory.

  - Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file     along with a specially linked Chart.lock file can lead to local code execution when dependencies are     updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are     updated and this file is written, can be crafted in a way that can cause execution if that same content     were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is     symlinked to one of these files updating dependencies will write the lock file content to the symlinked     file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due     to symlinking. This issue has been resolved in Helm v3.18.4. (CVE-2025-53547)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file
    along with a specially linked Chart.lock file can lead to local code execution when dependencies are
    updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are
    updated and this file is written, can be crafted in a way that can cause execution if that same content
    were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is
    symlinked to one of these files updating dependencies will write the lock file content to the symlinked
    file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due
    to symlinking. This issue has been resolved in Helm v3.18.4. (CVE-2025-53547)

ID	Name	Product	Family	Severity
277007	openSUSE 16 Security Update : trivy (openSUSE-SU-2025-20117-1)	Nessus	SuSE Local Security Checks	medium
276786	SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2025:4190-1)	Nessus	SuSE Local Security Checks	high
242232	CBL Mariner 2.0 Security Update: helm (CVE-2025-53547)	Nessus	MarinerOS Local Security Checks	high
428359	Alpine: multiple helm packages: security update to 3.18.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
428359	Alpine: multiple helm packages: security update to 3.18.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
428318	SCA: security update for helm.sh/helm/v3 (GHSA-557j-xg8c-q2mm)	Tenable Cloud Security	SCA Checks	high
428318	SCA: security update for helm.sh/helm/v3 (GHSA-557j-xg8c-q2mm)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-53547

high

Tenable Plugins

medium

high

high

high

high

high

high