CVE-2025-53547 is a command injection vulnerability in Helm (helm.sh/helm/v3) where an attacker can craft a malicious Chart.yaml with dependencies linked in a Chart.lock file. If the Chart.lock file is a symbolic link to an executable file, such as a shell script, and a user runs 'helm dependency update', the crafted content is written to and executed via the symlink, leading to local code execution. This vulnerability affects Red Hat OpenShift Container Platform versions prior to 4.14.57 and versions 4.17 and 4.18. The issue has been fixed in Helm version 3.18.4, and Red Hat has released OpenShift Container Platform 4.14.57 with the patched Helm packages. ArgoCD, another GitOps tool, is not vulnerable due to its usage patterns and scanning features.

Successful exploitation allows an attacker with local access to execute arbitrary code on the system running Helm by leveraging crafted Helm charts with malicious symbolic links. This can lead to privilege escalation or unauthorized control of the affected system. The vulnerability has a high severity rating due to the potential for local code execution without requiring elevated privileges, but user interaction is required to trigger the update process.

A fix is available in Red Hat OpenShift Container Platform 4.14.57, which includes updated Helm packages patched against this vulnerability. Users should upgrade to version 4.14.57 or later to remediate this issue. No effective mitigations meeting Red Hat's criteria are available other than applying the update. Users should follow Red Hat's official upgrade instructions using the OpenShift CLI or web console to apply the update.