Detections
Analytics
SCA: security update for helm.sh/helm, helm.sh/helm/v3 (GHSA-9vp5-m38w-j776)
low Tenable Self-Hosted Container Security Plugin ID 431950
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is
not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue
has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies`
field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not
contain newlines or path characters. (CVE-2020-15184)
See Also
Plugin Details
Severity: Low
ID: 431950
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 8/7/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-15184
CVSS v3
Risk Factor: Low
Base Score: 2.7
Temporal Score: 2.4
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/24/2021
Vulnerability Publication Date: 9/17/2020
Reference Information
CVE: CVE-2020-15184