CVE-2025-53547

What it actually does

Specially crafted Chart.yaml paired with a maliciously linked Chart.lock enables arbitrary local code execution during dependency update operations.

Why it matters to the business

Compromised developer workstations or CI pipelines can lead to supply-chain attacks, data theft, or further lateral movement with elevated urgency due to the 475 days since publication and rising EPSS trend.

How an attack unfolds

An attacker prepares malicious Chart.yaml and Chart.lock files that abuse the dependency resolution process; when a victim performs a dependency update the crafted files trigger code execution on the local system.

How to fix it

Upgrade affected Thunderbird packages on Debian 11 to version 1:128.12.0esr-1~deb11u1 or later; apply the same update process to any Helm-based tooling that consumes charts.

How to confirm the fix worked

Verify package versions match the fixed releases, re-test dependency updates with known-good charts, and confirm no unexpected binaries or scripts are created during update operations.

Typical attack path

1. Prepare malicious Chart.yaml and linked Chart.lock
2. Host or deliver the files to a target environment
3. Victim executes helm dependency update
4. Arbitrary code executes with the privileges of the updating process

How to detect it

Review command-line logs for helm dependency update invocations, inspect recently modified Chart.yaml or Chart.lock files in repositories, and search process execution history for unexpected binaries spawned during chart operations.

What your security team should do

• Immediately upgrade all instances to the listed fixed versions
• Scan build and developer systems for prior execution artifacts
• Restrict chart sources to trusted repositories
• Monitor EPSS trend for continued increase in exploit likelihood