GHSA-hr2v-4r36-88hr Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment

• Go helm.sh/helm/v4: < 4.1.4 → fixed in 4.1.4 • Go helm.sh/helm/v3: < 3.20.2 → fixed in 3.20.2

Helm is a package manager for Charts for Kubernetes. In Helm versions /`, instead of the expected `//`, potentially overwriting the contents of the targeted directory. Note: a chart name containing POSIX dot-dot, or dot-dot and slashes (as if to refer to parent directories) do not resolve beyond the output directory as designed. Patches This issue has been resolved in Helm v3.20.2 and v4.1.3 A Chart with an unexpected name (those specified to be "." or ".."), or a Chart name which results in a non-unique directory will be rejected. Workarounds Ensure the the name of the Chart does not comprise/contain POSIX pathname special directory references ie. dot-dot ("..") or dot ("."). In addition, ensuring that the `pull --untar` flag (or equivalent SDK option) refers to a unique/empty output directory prevents chart extraction from inadvertently overwriting existing files within the specified directory. Credits Oleh Konko @1seal