CVE-2026-35206: Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

April 10, 2026

Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart’s contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart’s name.

References

github.com/advisories/GHSA-hr2v-4r36-88hr
github.com/helm/helm
github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436
github.com/helm/helm/releases/tag/v4.1.4
github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr
nvd.nist.gov/vuln/detail/CVE-2026-35206

Code Behaviors & Features

Detect and mitigate CVE-2026-35206 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →