CVE-2025-53547: RCE in Helm Kubernetes Package Manager

The vulnerability stems from how Helm handles dependencies and updates Chart.lock files. An attacker can create a Chart.yaml file containing malicious content within specific fields. When Helm updates dependencies and writes the Chart.lock file, this malicious content is transferred. If the Chart.lock file is then symlinked to a file that is executed (like a bash.rc or shell script), the attacker can trigger arbitrary code execution on the system. This represents a significant risk, potentially allowing attackers to gain control of Kubernetes clusters and the underlying infrastructure. The blast radius extends to any system where the compromised Helm chart is deployed or managed.

1. Reserved2025-07-02
2. Published2025-07-08
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Helm to version 3.18.4 or later. Before upgrading, assess the potential impact on existing deployments and consider a staged rollout. If an immediate upgrade is not feasible, restrict access to Helm repositories and carefully review any charts before installation. Consider implementing a Web Application Firewall (WAF) or proxy to inspect Helm chart contents for suspicious patterns. Monitor Helm logs for unusual activity, particularly during dependency updates. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for unexpected file modifications in the Chart.lock file location is recommended.