{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35204.json"
      }
    ],
    "title": "github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin",
    "tracking": {
      "current_release_date": "2026-06-30T03:53:29+00:00",
      "generator": {
        "date": "2026-06-30T03:53:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.0"
        }
      },
      "id": "CVE-2026-35204",
      "initial_release_date": "2026-04-09T15:03:28.668000+00:00",
      "revision_history": [
        {
          "date": "2026-04-09T15:03:28.668000+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-17T14:10:06+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2026-06-30T03:53:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Helm CLI 4.1",
                "product": {
                  "name": "Helm CLI 4.1",
                  "product_id": "Helm CLI 4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:helm_cli:4.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Helm CLI"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@amd64_windows",
                "product": {
                  "name": "helm-cli@amd64_windows",
                  "product_id": "helm-cli@amd64_windows",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-windows-amd64.zip&checksum=sha256:981377e39848776108d53b073f578554989e37bb1e2edbec1914dc2ec9e276e7&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64_windows"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@arm64_windows",
                "product": {
                  "name": "helm-cli@arm64_windows",
                  "product_id": "helm-cli@arm64_windows",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-windows-arm64.zip&checksum=sha256:f42baf560541087b59217e1539816a1b18bf7cb707e0226327221054958f019b&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64_windows"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@amd64",
                "product": {
                  "name": "helm-cli@amd64",
                  "product_id": "helm-cli@amd64",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-linux-amd64.tar.gz&checksum=sha256:6f953797650167509d767d5d7a2cd6dbdded66e433fe633d083fe412f7b0917e&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@arm64",
                "product": {
                  "name": "helm-cli@arm64",
                  "product_id": "helm-cli@arm64",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-linux-arm64.tar.gz&checksum=sha256:fd3a0f2ae418b50aa7061d08ff27fd40eb90325a9ef9087609711959cc60fab3&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@ppc64le",
                "product": {
                  "name": "helm-cli@ppc64le",
                  "product_id": "helm-cli@ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-linux-ppc64le.tar.gz&checksum=sha256:7ee6552e0a6ba188ad6417be70caf26f725c3c448a0cd5907c23f4e61248929d&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@s390x",
                "product": {
                  "name": "helm-cli@s390x",
                  "product_id": "helm-cli@s390x",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-linux-s390x.tar.gz&checksum=sha256:5953204ca216fb9d2be355ff82ba1d942c8ee3152a79c8a0e8c465f9f20be114&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@amd64_darwin",
                "product": {
                  "name": "helm-cli@amd64_darwin",
                  "product_id": "helm-cli@amd64_darwin",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-darwin-amd64.tar.gz&checksum=sha256:8f2023aa2a658e47a4a8a67d8c9b828fb95f224b666e3bcd68aa02b54c71a1c3&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64_darwin"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "helm-cli@arm64_darwin",
                "product": {
                  "name": "helm-cli@arm64_darwin",
                  "product_id": "helm-cli@arm64_darwin",
                  "product_identification_helper": {
                    "purl": "pkg:generic/helm-cli@4.1.4?filename=helm-darwin-arm64.tar.gz&checksum=sha256:d5e5a6a3629e657cc462a3a9478acede304e9ee21de87854c411681d8d11c18c&download_url=https://developers.redhat.com/products"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64_darwin"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@amd64 as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@amd64"
        },
        "product_reference": "helm-cli@amd64",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@amd64_darwin as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@amd64_darwin"
        },
        "product_reference": "helm-cli@amd64_darwin",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@amd64_windows as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@amd64_windows"
        },
        "product_reference": "helm-cli@amd64_windows",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@arm64 as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@arm64"
        },
        "product_reference": "helm-cli@arm64",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@arm64_darwin as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@arm64_darwin"
        },
        "product_reference": "helm-cli@arm64_darwin",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@arm64_windows as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@arm64_windows"
        },
        "product_reference": "helm-cli@arm64_windows",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@ppc64le as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@ppc64le"
        },
        "product_reference": "helm-cli@ppc64le",
        "relates_to_product_reference": "Helm CLI 4.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "helm-cli@s390x as a component of Helm CLI 4.1",
          "product_id": "Helm CLI 4.1:helm-cli@s390x"
        },
        "product_reference": "helm-cli@s390x",
        "relates_to_product_reference": "Helm CLI 4.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-35204",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "discovery_date": "2026-04-09T16:01:36.464601+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456933"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Helm, a package manager for Kubernetes. An attacker could exploit this vulnerability by providing a specially crafted Helm plugin. When such a plugin is installed or updated, Helm incorrectly processes its configuration, allowing the plugin's contents to be written to an arbitrary location on the filesystem. This could lead to unauthorized modification of system files or other critical data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Helm CLI 4.1:helm-cli@amd64",
          "Helm CLI 4.1:helm-cli@amd64_darwin",
          "Helm CLI 4.1:helm-cli@amd64_windows",
          "Helm CLI 4.1:helm-cli@arm64",
          "Helm CLI 4.1:helm-cli@arm64_darwin",
          "Helm CLI 4.1:helm-cli@arm64_windows",
          "Helm CLI 4.1:helm-cli@ppc64le",
          "Helm CLI 4.1:helm-cli@s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35204"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456933",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456933"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35204",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35204"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35204",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35204"
        },
        {
          "category": "external",
          "summary": "https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027",
          "url": "https://github.com/helm/helm/commit/36c8539e99bc42d7aef9b87d136254662d04f027"
        },
        {
          "category": "external",
          "summary": "https://github.com/helm/helm/releases/tag/v4.1.4",
          "url": "https://github.com/helm/helm/releases/tag/v4.1.4"
        },
        {
          "category": "external",
          "summary": "https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg",
          "url": "https://github.com/helm/helm/security/advisories/GHSA-vmx8-mqv2-9gmg"
        }
      ],
      "release_date": "2026-04-09T15:03:28.668000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-16T20:29:05+00:00",
          "details": "Download the Helm CLI v4.1.4 binaries for your platform from https://mirror.openshift.com/pub/cgw/helm/4.1.4/",
          "product_ids": [
            "Helm CLI 4.1:helm-cli@amd64",
            "Helm CLI 4.1:helm-cli@amd64_darwin",
            "Helm CLI 4.1:helm-cli@amd64_windows",
            "Helm CLI 4.1:helm-cli@arm64",
            "Helm CLI 4.1:helm-cli@arm64_darwin",
            "Helm CLI 4.1:helm-cli@arm64_windows",
            "Helm CLI 4.1:helm-cli@ppc64le",
            "Helm CLI 4.1:helm-cli@s390x"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:26441"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Helm CLI 4.1:helm-cli@amd64",
            "Helm CLI 4.1:helm-cli@amd64_darwin",
            "Helm CLI 4.1:helm-cli@amd64_windows",
            "Helm CLI 4.1:helm-cli@arm64",
            "Helm CLI 4.1:helm-cli@arm64_darwin",
            "Helm CLI 4.1:helm-cli@arm64_windows",
            "Helm CLI 4.1:helm-cli@ppc64le",
            "Helm CLI 4.1:helm-cli@s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Helm CLI 4.1:helm-cli@amd64",
            "Helm CLI 4.1:helm-cli@amd64_darwin",
            "Helm CLI 4.1:helm-cli@amd64_windows",
            "Helm CLI 4.1:helm-cli@arm64",
            "Helm CLI 4.1:helm-cli@arm64_darwin",
            "Helm CLI 4.1:helm-cli@arm64_windows",
            "Helm CLI 4.1:helm-cli@ppc64le",
            "Helm CLI 4.1:helm-cli@s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important",
          "product_ids": [
            "Helm CLI 4.1:helm-cli@amd64",
            "Helm CLI 4.1:helm-cli@amd64_darwin",
            "Helm CLI 4.1:helm-cli@amd64_windows",
            "Helm CLI 4.1:helm-cli@arm64",
            "Helm CLI 4.1:helm-cli@arm64_darwin",
            "Helm CLI 4.1:helm-cli@arm64_windows",
            "Helm CLI 4.1:helm-cli@ppc64le",
            "Helm CLI 4.1:helm-cli@s390x"
          ]
        }
      ],
      "title": "github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin"
    }
  ]
}