CVE-2025-55198

What it actually does

Improper type validation during parsing of Chart.yaml and index.yaml files allows malformed type data to trigger an unhandled panic in the Helm chart processing logic.

Why it matters to the business

Attackers can cause Helm operations to crash, interrupting package installation, upgrades, and repository indexing across Linux distributions and Git-based deployments.

How an attack unfolds

An attacker crafts a Chart.yaml or index.yaml containing an unexpected data type, supplies it via a chart archive or repository index, and triggers the panic when Helm parses the file during install, upgrade, or repo operations.

How to fix it

Upgrade to fixed versions: Debian 12/13 packages 6.0.2-1 or later; helm/helm Git revision b78692c18f0fb38fe5ba4571a674de067a4c53a5 or newer. Rebuild any custom pipelines or containers to use the patched Helm binary.

How to confirm the fix worked

Confirm the running Helm binary reports a version at or above the fixed releases, then attempt to parse known-malformed test YAML files to verify absence of panic.

Typical attack path

1. Identify a target Helm environment that processes untrusted or attacker-controlled charts
2. Create a malicious Chart.yaml or index.yaml with invalid type values
3. Host the file in a chart tarball or repository index reachable by the target
4. Trigger Helm commands such as install, upgrade, or repo update that parse the file
5. Observe application panic and termination

How to detect it

Review Helm process logs, container stdout/stderr, and orchestration platform events for sudden panics or abnormal terminations during chart parsing; correlate with file modification timestamps on Chart.yaml and index.yaml.

What your security team should do

• Prioritize patching all Helm installations to the listed fixed versions within standard change windows
• Scan internal and third-party chart repositories for Chart.yaml and index.yaml files that could contain unexpected types
• Update CI/CD pipelines and container images to reference only patched Helm versions
• Monitor for Helm process crashes in logs and alerting systems