## https://sploitus.com/exploit?id=4F66F675-50EA-5F1B-87AC-13AB3997231F
# CVE-2025-53547 POC
this is a poc for CVE-2025-53547
`Chart.lock` links test file to /tmp/1.txt
/tmp/1.txt inject a command that create /tmp/2.txt
In real product enviroment, you can change `Chart.lock` link file to inject any command you want such as:
* /root/.bash_rc
* /root/.bash_profile
* /etc/profile
......
or any can run shell script file.
then change the `Chart.yaml` dependency repository url params to run other command.
## Usage
helm <= 3.18.3
first run
```bash
helm dependency update
```
then you'll find `/tmp/1.txt`
then run
```bash
bash /tmp/1.txt
```
then you'll find `/tmp/2.txt`
## Reference
https://github.com/helm/helm/security/advisories/GHSA-557j-xg8c-q2mm
https://github.com/helm/helm/compare/v3.18.3...v3.18.4