Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
LOW severity

plugin.yaml file allows for duplicate entries in helmGHSA-c52f-pq47-2r9j

LOWFix: helm/helm@6aab637

GHSA-c52f-pq47-2r9j is a low-severity (CVSS 3) CWE-74 vulnerability in helm.sh/helm/v3. A fix is available for helm.sh/helm/v3 — see the affected versions and patch details below.

Also known asBIT-helm-2020-15187CVE-2020-15187
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs74th percentile — riskier than 74% of all scored CVEsHighest risk
0.00%0.67%1.34%2.02%0.2%1.5%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-c52f-pq47-2r9j by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
🐹helm.sh/helm/v3🐹helm.sh/helm

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.

To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection).

Patches

This issue has been patched in Helm 2.16.11 and Helm 3.3.2.

Workarounds

Make sure to install plugins using a secure connection protocol like SSL.

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gohelm.sh/helm/v3≥ 3.0.0&&< 3.3.23.3.2go get helm.sh/helm/v3@v3.3.2
🐹Gohelm.sh/helm≥ 2.0.0&&< 2.16.112.16.11go get helm.sh/helm@v2.16.11

Affected Products

1 product · 2 configurations
Application
helmhelm
≥ 3.0.0 && < 3.3.2
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for helm.sh/helm/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update helm.sh/helm/v3 to 3.3.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c52f-pq47-2r9j is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact During a security audit of Helm's code base, Helm maintainers identified a bug in which a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack. To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). ### Patches This issue has been patched in Helm 2.16.11 and Helm
O3 Security · Impact-Aware SCA

Is GHSA-c52f-pq47-2r9j in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-c52f-pq47-2r9j: helm — Fixed in 3.3.2