CVE-2020-15184: 
Helm vulnerability analysis and mitigation

In Helm before versions 2.16.11 and 3.3.2, a security vulnerability was identified where plugin names (aliases) were not properly sanitized. This vulnerability, tracked as CVE-2020-15184, was discovered during a security audit conducted by Trail of Bits researchers and was disclosed on September 17, 2020 (GitHub Advisory).

The vulnerability exists in the alias field validation of Chart.yaml files. The issue stems from improper sanitization of the alias field, which could potentially allow for injection of unwanted information into a chart. The vulnerability affects Helm versions 2.0.0-2.16.10 and 3.0.0-3.3.1. The severity of this vulnerability is rated as LOW with a CVSS v3.1 score of 2.7 (NVD Results).

The vulnerability could lead to the injection of unwanted information into a chart through unsanitized alias fields. While the impact is considered low, it could potentially affect chart integrity if exploited (GitHub Advisory).

The vulnerability can be exploited through the manipulation of the alias field in Chart.yaml dependencies. An attacker would need to create a malicious chart with specially crafted alias values containing newlines or path characters (GitHub Advisory).

The issue has been patched in Helm versions 3.3.2 and 2.16.11. For users unable to upgrade immediately, a manual workaround is available: review the dependencies field of any untrusted chart, verifying that the alias field is either not used, or if used, does not contain newlines or path characters (GitHub Advisory).