Nixpkgs security tracker

Untriaged

Permalink CVE-2026-63308

5.3 MEDIUM

CVSS version (CVSS): 4.0
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Attack Requirement (AT): None (N)
Privileges Required (PR): None (N)
User Interaction (UI): Passive (P)
Vulnerable System Impact Confidentiality (VC): None (N)
Vulnerable System Impact Integrity (VI): None (N)
Vulnerable System Impact Availability (VA): Low (L)
Subsequent System Impact Confidentiality (SC): None (N)
Subsequent System Impact Integrity (SI): None (N)
Subsequent System Impact Availability (SA): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Attack Requirement (MAT): None (N)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Passive (P)
Modified Vulnerable System Impact Confidentiality (MVC): None (N)
Modified Vulnerable System Impact Integrity (MVI): None (N)
Modified Vulnerable System Impact Availability (MVA): Low (L)
Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
Modified Subsequent System Impact Integrity (MSI): Negligible (N)
Modified Subsequent System Impact Availability (MSA): Negligible (N)
Safety (S): Not Defined (X)
Automatable (AU): Not Defined (X)
Recovery (R): Not Defined (X)
Value Density (V): Not Defined (X)
Vulnerability Response Effort (RE): Not Defined (X)
Provider Urgency (U): Not Defined (X)
Confidentiality Req. (CR): Not Defined (X)
Integrity Req. (IR): Not Defined (X)
Availability Req. (AR): Not Defined (X)
Exploit Maturity (E): Not Defined (X)

created 3 days, 23 hours ago Activity log

Created suggestion 3 days, 23 hours ago

Helm Files.Lines Denial of Service via Empty Chart Files

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

References

Researcher Disclosure technical-descriptionexploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/chat2db-insecure-direct-object-reference-v… third-party-advisory

Affected products

helm

=<4.2.3
==ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017

Matching in nixpkgs

pkgs.helm

Free, cross-platform, polyphonic synthesizer

nixos-unstable 0.9.0
- nixpkgs-unstable 0.9.0
- nixos-unstable-small 0.9.0
nixos-26.05 0.9.0
- nixos-26.05-small 0.9.0
- nixpkgs-26.05-darwin 0.9.0

pkgs.helm-ls

Language server for Helm

nixos-unstable 0.5.4
- nixpkgs-unstable 0.5.4
- nixos-unstable-small 0.5.4
nixos-26.05 0.5.4
- nixos-26.05-small 0.5.4
- nixpkgs-26.05-darwin 0.5.4

pkgs.helmify

Creates Helm chart from Kubernetes yaml

nixos-unstable 0.4.20
- nixpkgs-unstable 0.4.20
- nixos-unstable-small 0.4.20

pkgs.helmfile

Declarative spec for deploying Helm charts

nixos-unstable 1.6.0
- nixpkgs-unstable 1.6.0
- nixos-unstable-small 1.6.0
nixos-26.05 1.5.0
- nixos-26.05-small 1.5.0
- nixpkgs-26.05-darwin 1.5.0

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

nixos-unstable 4.0.5
- nixpkgs-unstable 4.0.5
- nixos-unstable-small 4.0.5
nixos-26.05 4.0.5
- nixos-26.05-small 4.0.5
- nixpkgs-26.05-darwin 4.0.5

pkgs.helm-docs

Tool for automatically generating markdown documentation for Helm charts

nixos-unstable 1.14.2
- nixpkgs-unstable 1.14.2
- nixos-unstable-small 1.14.2
nixos-26.05 1.14.2
- nixos-26.05-small 1.14.2
- nixpkgs-26.05-darwin 1.14.2

pkgs.helmholtz

Time domain pitch tracker for Pure Data

nixos-unstable 1.0
- nixpkgs-unstable 1.0
- nixos-unstable-small 1.0
nixos-26.05 1.0
- nixos-26.05-small 1.0
- nixpkgs-26.05-darwin 1.0

pkgs.helm-dashboard

Simplified way of working with Helm

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.3
nixos-26.05 1.3.3
- nixos-26.05-small 1.3.3
- nixpkgs-26.05-darwin 1.3.3

pkgs.kubernetes-helm

Package manager for kubernetes

nixos-unstable 4.2.2
- nixpkgs-unstable 4.2.2
- nixos-unstable-small 4.2.2
nixos-26.05 3.20.2
- nixos-26.05-small 3.20.2
- nixpkgs-26.05-darwin 3.20.2

pkgs.helmfile-wrapped

Declarative spec for deploying Helm charts

nixos-unstable 1.6.0
- nixpkgs-unstable 1.6.0
- nixos-unstable-small 1.6.0
nixos-26.05 1.5.0
- nixos-26.05-small 1.5.0
- nixpkgs-26.05-darwin 1.5.0

pkgs.terraform-providers.helm

None

nixos-unstable 3.2.0
- nixpkgs-unstable 3.2.0
- nixos-unstable-small 3.2.0
nixos-26.05 3.1.1
- nixos-26.05-small 3.1.1
- nixpkgs-26.05-darwin 3.1.1

pkgs.kubernetes-helmPlugins.helm-dt

Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier

nixos-unstable 0.8.0
- nixpkgs-unstable 0.8.0
- nixos-unstable-small 0.8.0
nixos-26.05 0.7.1
- nixos-26.05-small 0.7.1
- nixpkgs-26.05-darwin 0.7.1

pkgs.kubernetes-helmPlugins.helm-s3

Helm plugin that allows to set up a chart repository using AWS S3

nixos-unstable 0.17.2
- nixpkgs-unstable 0.17.2
- nixos-unstable-small 0.17.2
nixos-26.05 0.17.1
- nixos-26.05-small 0.17.1
- nixpkgs-26.05-darwin 0.17.1

pkgs.kubernetes-helmPlugins.helm-git

Helm downloader plugin that provides GIT protocol support

nixos-unstable 1.5.2
- nixpkgs-unstable 1.5.2
- nixos-unstable-small 1.5.2
nixos-26.05 1.5.2
- nixos-26.05-small 1.5.2
- nixpkgs-26.05-darwin 1.5.2

pkgs.kubernetes-helmPlugins.helm-diff

Helm plugin that shows a diff

nixos-unstable 3.15.9
- nixpkgs-unstable 3.15.9
- nixos-unstable-small 3.15.9
nixos-26.05 3.15.7
- nixos-26.05-small 3.15.7
- nixpkgs-26.05-darwin 3.15.7

pkgs.kubernetes-helmPlugins.helm-schema

Helm plugin for generating values.schema.json from multiple values files

nixos-unstable 2.4.0
- nixpkgs-unstable 2.4.0
- nixos-unstable-small 2.4.0
nixos-26.05 2.4.0
- nixos-26.05-small 2.4.0
- nixpkgs-26.05-darwin 2.4.0

pkgs.terraform-providers.hashicorp_helm

None

nixos-unstable 3.2.0
- nixpkgs-unstable 3.2.0
- nixos-unstable-small 3.2.0
nixos-26.05 3.1.1
- nixos-26.05-small 3.1.1
- nixpkgs-26.05-darwin 3.1.1

pkgs.kubernetes-helmPlugins.helm-cm-push

Helm plugin to push chart package to ChartMuseum

nixos-unstable 0.11.1
- nixpkgs-unstable 0.11.1
- nixos-unstable-small 0.11.1
nixos-26.05 0.11.1
- nixos-26.05-small 0.11.1
- nixpkgs-26.05-darwin 0.11.1

pkgs.kubernetes-helmPlugins.helm-secrets

Helm plugin that helps manage secrets

nixos-unstable 4.7.6
- nixpkgs-unstable 4.7.6
- nixos-unstable-small 4.7.6
nixos-26.05 4.6.10
- nixos-26.05-small 4.6.10
- nixpkgs-26.05-darwin 4.6.10

pkgs.kubernetes-helmPlugins.helm-unittest

BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.0
- nixos-26.05-small 1.1.0
- nixpkgs-26.05-darwin 1.1.0

pkgs.kubernetes-helmPlugins.helm-mapkubeapis

Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs

nixos-unstable 0.6.1
- nixpkgs-unstable 0.6.1
- nixos-unstable-small 0.6.1
nixos-26.05 0.6.1
- nixos-26.05-small 0.6.1
- nixpkgs-26.05-darwin 0.6.1

pkgs.vimPlugins.nvim-treesitter-parsers.helm

Tree-sitter grammar for helm

nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63
nixos-26.05 0.0.0+rev=aa71f63
- nixos-26.05-small 0.0.0+rev=aa71f63
- nixpkgs-26.05-darwin 0.0.0+rev=aa71f63

pkgs.vscode-extensions.tim-koehler.helm-intellisense

Extension to help writing Helm-Templates by providing intellisense

nixos-unstable 0.15.0
- nixpkgs-unstable 0.15.0
- nixos-unstable-small 0.15.0
nixos-26.05 0.15.0
- nixos-26.05-small 0.15.0
- nixpkgs-26.05-darwin 0.15.0

pkgs.tree-sitter-grammars.tree-sitter-go-template-helm

Tree-sitter grammar for go-template-helm

nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21
nixos-26.05 0-unstable-2026-03-21
- nixos-26.05-small 0-unstable-2026-03-21
- nixpkgs-26.05-darwin 0-unstable-2026-03-21

pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
nixos-26.05 0+unstable20260321
- nixos-26.05-small 0+unstable20260321
- nixpkgs-26.05-darwin 0+unstable20260321

pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321
nixos-26.05 0+unstable20260321
- nixos-26.05-small 0+unstable20260321
- nixpkgs-26.05-darwin 0+unstable20260321

Package maintainers

@magnetophon Bart Brouns <bart@magnetophon.nl>
@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
@stehessel Stephan Heßelmann <stephan@stehessel.de>
@yurrriq Eric Bailey <eric@ericb.me>
@jlesquembre José Luis Lafuente <jl@lafuente.me>
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
@techknowlogick techknowlogick <techknowlogick@gitea.com>
@Frostman Sergei Lukianov <me@slukjanov.name>
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
@edude03 Michael Francis <michael@melenion.com>
@a1994sc Allen Conlon <software@conlon.dev>
@flokli Florian Klink <flokli@flokli.de>
@aos aos <n@aos.sh>
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@stepbrobd Yifei Sun <ysun@hey.com>
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
@adfaure Adrien Faure <adfaure@pm.me>
@A-jay98 Ali Jamadi <ali@jamadi.me>
@azahi Azat Bahawi <azat@bahawi.net>

Untriaged

Permalink CVE-2026-35205

created 3 months, 2 weeks ago Activity log

Created suggestion 3 months, 2 weeks ago

Helm's plugin verification fails open when .prov is missing, allowing unsigned plugin install

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance (.prov file) when signature verification is required. This vulnerability is fixed in 4.1.4.

References

https://github.com/helm/helm/security/advisories/GHSA-q5jf-9vfq-h4h7 x_refsource_CONFIRM
https://github.com/helm/helm/commit/05fa37973dc9e42b76e1d2883494c87174b6074f x_refsource_MISC
https://github.com/helm/helm/releases/tag/v4.1.4 x_refsource_MISC
https://helm.sh/docs/topics/provenance/#the-provenance-file x_refsource_MISC

Affected products

helm

==>= 4.0.0, < 4.1.4

Matching in nixpkgs

pkgs.helm

Free, cross-platform, polyphonic synthesizer

nixos-unstable 0.9.0
- nixpkgs-unstable 0.9.0
- nixos-unstable-small 0.9.0

pkgs.helm-ls

Language server for Helm

nixos-unstable 0.5.4
- nixpkgs-unstable 0.5.4
- nixos-unstable-small 0.5.4

pkgs.helmfile

Declarative spec for deploying Helm charts

nixos-unstable 1.4.3
- nixpkgs-unstable 1.4.3
- nixos-unstable-small 1.4.3

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

nixos-unstable 4.0.5
- nixpkgs-unstable 4.0.5
- nixos-unstable-small 4.0.5

pkgs.helm-docs

Tool for automatically generating markdown documentation for Helm charts

nixos-unstable 1.14.2
- nixpkgs-unstable 1.14.2
- nixos-unstable-small 1.14.2

pkgs.helmholtz

Time domain pitch tracker for Pure Data

nixos-unstable 1.0
- nixpkgs-unstable 1.0
- nixos-unstable-small 1.0

pkgs.helm-dashboard

Simplified way of working with Helm

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.3

pkgs.kubernetes-helm

Package manager for kubernetes

nixos-unstable 3.19.1
- nixpkgs-unstable 3.19.1
- nixos-unstable-small 3.19.1

pkgs.helmfile-wrapped

Declarative spec for deploying Helm charts

nixos-unstable 1.4.3
- nixpkgs-unstable 1.4.3
- nixos-unstable-small 1.4.3

pkgs.terraform-providers.helm

None

nixos-unstable 3.1.1
- nixpkgs-unstable 3.1.1
- nixos-unstable-small 3.1.1

pkgs.kubernetes-helmPlugins.helm-dt

Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier

nixos-unstable 0.4.12
- nixpkgs-unstable 0.4.12
- nixos-unstable-small 0.4.12

pkgs.kubernetes-helmPlugins.helm-s3

Helm plugin that allows to set up a chart repository using AWS S3

nixos-unstable s3-0.17.1
- nixpkgs-unstable s3-0.17.1
- nixos-unstable-small s3-0.17.1

pkgs.kubernetes-helmPlugins.helm-git

Helm downloader plugin that provides GIT protocol support

nixos-unstable 1.5.2
- nixpkgs-unstable 1.5.2
- nixos-unstable-small 1.5.2

pkgs.kubernetes-helmPlugins.helm-diff

Helm plugin that shows a diff

nixos-unstable 3.15.4
- nixpkgs-unstable 3.15.4
- nixos-unstable-small 3.15.4

pkgs.kubernetes-helmPlugins.helm-schema

Helm plugin for generating values.schema.json from multiple values files

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.3.1

pkgs.terraform-providers.hashicorp_helm

None

nixos-unstable 3.1.1
- nixpkgs-unstable 3.1.1
- nixos-unstable-small 3.1.1

pkgs.kubernetes-helmPlugins.helm-cm-push

Helm plugin to push chart package to ChartMuseum

nixos-unstable 0.11.1
- nixpkgs-unstable 0.11.1
- nixos-unstable-small 0.11.1

pkgs.kubernetes-helmPlugins.helm-secrets

Helm plugin that helps manage secrets

nixos-unstable 4.6.10
- nixpkgs-unstable 4.6.10
- nixos-unstable-small 4.6.10

pkgs.kubernetes-helmPlugins.helm-unittest

BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3

pkgs.kubernetes-helmPlugins.helm-mapkubeapis

Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs

nixos-unstable 0.6.1
- nixpkgs-unstable 0.6.1
- nixos-unstable-small 0.6.1

pkgs.vimPlugins.nvim-treesitter-parsers.helm

Tree-sitter grammar for helm

nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63

pkgs.vscode-extensions.tim-koehler.helm-intellisense

Extension to help writing Helm-Templates by providing intellisense

nixos-unstable 0.15.0
- nixpkgs-unstable 0.15.0
- nixos-unstable-small 0.15.0

pkgs.tree-sitter-grammars.tree-sitter-go-template-helm

Tree-sitter grammar for go-template-helm

nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21

pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321

pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321

Package maintainers

@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
@stehessel Stephan Heßelmann <stephan@stehessel.de>
@kliu128 Kevin Liu <kevin@potatofrom.space>
@yurrriq Eric Bailey <eric@ericb.me>
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
@techknowlogick techknowlogick <techknowlogick@gitea.com>
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
@edude03 Michael Francis <michael@melenion.com>
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@Frostman Sergei Lukianov <me@slukjanov.name>
@a1994sc Allen Conlon <software@conlon.dev>
@flokli Florian Klink <flokli@flokli.de>
@aos aos <n@aos.sh>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
@adfaure Adrien Faure <adfaure@pm.me>
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
@stepbrobd Yifei Sun <ysun@hey.com>
@A-jay98 Ali Jamadi <ali@jamadi.me>
@azahi Azat Bahawi <azat@bahawi.net>

Untriaged

Permalink CVE-2026-35206

created 3 months, 2 weeks ago Activity log

Created suggestion 3 months, 2 weeks ago

Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.

References

https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr x_refsource_CONFIRM
https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436 x_refsource_MISC
https://github.com/helm/helm/releases/tag/v4.1.4 x_refsource_MISC

Affected products

helm

==< 3.20.2
==>= 4.0.0, < 4.1.4

Matching in nixpkgs

pkgs.helm

Free, cross-platform, polyphonic synthesizer

nixos-unstable 0.9.0
- nixpkgs-unstable 0.9.0
- nixos-unstable-small 0.9.0

pkgs.helm-ls

Language server for Helm

nixos-unstable 0.5.4
- nixpkgs-unstable 0.5.4
- nixos-unstable-small 0.5.4

pkgs.helmfile

Declarative spec for deploying Helm charts

nixos-unstable 1.4.3
- nixpkgs-unstable 1.4.3
- nixos-unstable-small 1.4.3

pkgs.helmsman

Helm Charts (k8s applications) as Code tool

nixos-unstable 4.0.5
- nixpkgs-unstable 4.0.5
- nixos-unstable-small 4.0.5

pkgs.helm-docs

Tool for automatically generating markdown documentation for Helm charts

nixos-unstable 1.14.2
- nixpkgs-unstable 1.14.2
- nixos-unstable-small 1.14.2

pkgs.helmholtz

Time domain pitch tracker for Pure Data

nixos-unstable 1.0
- nixpkgs-unstable 1.0
- nixos-unstable-small 1.0

pkgs.helm-dashboard

Simplified way of working with Helm

nixos-unstable 1.3.3
- nixpkgs-unstable 1.3.3
- nixos-unstable-small 1.3.3

pkgs.kubernetes-helm

Package manager for kubernetes

nixos-unstable 3.19.1
- nixpkgs-unstable 3.19.1
- nixos-unstable-small 3.19.1

pkgs.helmfile-wrapped

Declarative spec for deploying Helm charts

nixos-unstable 1.4.3
- nixpkgs-unstable 1.4.3
- nixos-unstable-small 1.4.3

pkgs.terraform-providers.helm

None

nixos-unstable 3.1.1
- nixpkgs-unstable 3.1.1
- nixos-unstable-small 3.1.1

pkgs.kubernetes-helmPlugins.helm-dt

Helm Distribution plugin is is a set of utilities and Helm Plugin for making offline work with Helm Charts easier

nixos-unstable 0.4.12
- nixpkgs-unstable 0.4.12
- nixos-unstable-small 0.4.12

pkgs.kubernetes-helmPlugins.helm-s3

Helm plugin that allows to set up a chart repository using AWS S3

nixos-unstable s3-0.17.1
- nixpkgs-unstable s3-0.17.1
- nixos-unstable-small s3-0.17.1

pkgs.kubernetes-helmPlugins.helm-git

Helm downloader plugin that provides GIT protocol support

nixos-unstable 1.5.2
- nixpkgs-unstable 1.5.2
- nixos-unstable-small 1.5.2

pkgs.kubernetes-helmPlugins.helm-diff

Helm plugin that shows a diff

nixos-unstable 3.15.4
- nixpkgs-unstable 3.15.4
- nixos-unstable-small 3.15.4

pkgs.kubernetes-helmPlugins.helm-schema

Helm plugin for generating values.schema.json from multiple values files

nixos-unstable 2.3.1
- nixpkgs-unstable 2.3.1
- nixos-unstable-small 2.3.1

pkgs.terraform-providers.hashicorp_helm

None

nixos-unstable 3.1.1
- nixpkgs-unstable 3.1.1
- nixos-unstable-small 3.1.1

pkgs.kubernetes-helmPlugins.helm-cm-push

Helm plugin to push chart package to ChartMuseum

nixos-unstable 0.11.1
- nixpkgs-unstable 0.11.1
- nixos-unstable-small 0.11.1

pkgs.kubernetes-helmPlugins.helm-secrets

Helm plugin that helps manage secrets

nixos-unstable 4.6.10
- nixpkgs-unstable 4.6.10
- nixos-unstable-small 4.6.10

pkgs.kubernetes-helmPlugins.helm-unittest

BDD styled unit test framework for Kubernetes Helm charts as a Helm plugin

nixos-unstable 1.0.3
- nixpkgs-unstable 1.0.3
- nixos-unstable-small 1.0.3

pkgs.kubernetes-helmPlugins.helm-mapkubeapis

Helm plugin which maps deprecated or removed Kubernetes APIs in a release to supported APIs

nixos-unstable 0.6.1
- nixpkgs-unstable 0.6.1
- nixos-unstable-small 0.6.1

pkgs.vimPlugins.nvim-treesitter-parsers.helm

Tree-sitter grammar for helm

nixos-unstable 0.0.0+rev=aa71f63
- nixpkgs-unstable 0.0.0+rev=aa71f63
- nixos-unstable-small 0.0.0+rev=aa71f63

pkgs.vscode-extensions.tim-koehler.helm-intellisense

Extension to help writing Helm-Templates by providing intellisense

nixos-unstable 0.15.0
- nixpkgs-unstable 0.15.0
- nixos-unstable-small 0.15.0

pkgs.tree-sitter-grammars.tree-sitter-go-template-helm

Tree-sitter grammar for go-template-helm

nixos-unstable 0-unstable-2026-03-21
- nixpkgs-unstable 0-unstable-2026-03-21
- nixos-unstable-small 0-unstable-2026-03-21

pkgs.python313Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321

pkgs.python314Packages.tree-sitter-grammars.tree-sitter-go-template-helm

Python bindings for tree-sitter-go-template-helm

nixos-unstable 0+unstable20260321
- nixpkgs-unstable 0+unstable20260321
- nixos-unstable-small 0+unstable20260321

Package maintainers

@Bot-wxt1221 Bot-wxt1221 <3264117476@qq.com>
@magnetophon Bart Brouns <bart@magnetophon.nl>
@qjoly Quentin JOLY <github@une-pause-cafe.fr>
@sagikazarmark Mark Sagi-Kazar <mark.sagikazar@gmail.com>
@stehessel Stephan Heßelmann <stephan@stehessel.de>
@kliu128 Kevin Liu <kevin@potatofrom.space>
@yurrriq Eric Bailey <eric@ericb.me>
@Lynty Lynn Dong <ltdong93+nix@gmail.com>
@sarcasticadmin Robert James Hernandez <rob@sarcasticadmin.com>
@techknowlogick techknowlogick <techknowlogick@gitea.com>
@Chili-Man Diego Rodriguez <dr.elhombrechile@gmail.com>
@rlupton20 Richard Lupton <richard.lupton@gmail.com>
@edude03 Michael Francis <michael@melenion.com>
@saschagrunert Sascha Grunert <mail@saschagrunert.de>
@Frostman Sergei Lukianov <me@slukjanov.name>
@a1994sc Allen Conlon <software@conlon.dev>
@flokli Florian Klink <flokli@flokli.de>
@aos aos <n@aos.sh>
@booxter Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
@applejag Kalle Fagerberg <applejag.luminance905@passmail.com>
@adfaure Adrien Faure <adfaure@pm.me>
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
@stepbrobd Yifei Sun <ysun@hey.com>
@A-jay98 Ali Jamadi <ali@jamadi.me>
@azahi Azat Bahawi <azat@bahawi.net>

Untriaged

Permalink CVE-2026-35204

created 3 months, 2 weeks ago Activity log

Created suggestion 3 months, 2 weeks ago

Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem location. To prevent this, validate that the plugin.yaml of the Helm plugin does not include a version: field containing POSIX dot-dot path separators ie. "/../". This vulnerability is fixed in 4.1.4.