{"action":"Upgrade github.com/fluxcd/helm-controller to 0.19.0 or later.","affected":[{"fixed":"0.19.0","introduced":"0.2.0"}],"component":"github.com/fluxcd/helm-controller","cve_ids":["CVE-2022-24817"],"ecosystem":"Go","epss":0.01118,"exploited":false,"fixed_versions":["0.19.0"],"ghsa_id":"GHSA-vvmq-fwmg-2gjc","id":"tcs_01M5KFPQK9T6KR96CANMX88RMX","modified_at":"2025-12-02T18:27:40.180830Z","published_at":"2022-05-16T18:13:51Z","references":["https://osv.dev/vulnerability/GHSA-vvmq-fwmg-2gjc","https://github.com/fluxcd/flux2/security/advisories/GHSA-vvmq-fwmg-2gjc","https://nvd.nist.gov/vuln/detail/CVE-2022-24817","https://github.com/fluxcd/flux2"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-vvmq-fwmg-2gjc#Go/github.com/fluxcd/helm-controller","url":"https://osv.dev/vulnerability/GHSA-vvmq-fwmg-2gjc"}],"summary":"Improper kubeconfig validation allows arbitrary code execution"}