Detections
Analytics
SCA: security update for helm.sh/helm, helm.sh/helm/v3 (GHSA-m54r-vrmv-hw33)
low Tenable Cloud Security Plugin ID 431893
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a
malicious plugin author could use characters in a plugin name that would result in unexpected behavior,
such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has
been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the
`name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-]
range. (CVE-2020-15186)
See Also
Plugin Details
Severity: Low
ID: 431893
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/7/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-15186
CVSS v3
Risk Factor: Low
Base Score: 2.7
Temporal Score: 2.4
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/24/2021
Vulnerability Publication Date: 9/17/2020
Reference Information
CVE: CVE-2020-15186