GO-2025-4223 RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows

RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows...

BIT-ARGO-WORKFLOWS-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

CVE-2025-66626

A path traversal and arbitrary file overwrite vulnerability has been identified in Argo Workflows during the extraction of archived artifacts, where symbolic links inside a crafted archive are not safely validated before file extraction. An attacker could exploit this flaw by submitting a malicio...

CVE-2025-66626

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal in the untar process. An attacker can execute arbitrary code with elevated privileges by crafting a malicious archive containing symbolic links that overwrite critical files such as /var/run/argo/argoexec, which...

CVE-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

CVE-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

CVE-2025-66626 argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

CVE-2025-66626

Argo Workflows CVE-2025-66626 affects the container-native workflow engine. Versions ≤3.6.13 and 3.7.0–3.7.4 contain unsafe untar code that mishandles symbolic links, allowing an attacker to overwrite /var/run/argo/argoexec with a script executed at pod startup. The patch for CVE-2025-62156 is in...

EUVD-2025-202177

RCE via ZipSlip and symbolic links in argoproj/argo-workflows...

RCE via ZipSlip and symbolic links in argoproj/argo-workflows

Summary The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. Details The untar code that handles symbolic links in archives is unsafe. Concretely, the computation of the link's target and the subsequent check are flawed:...

GHSA-XRQC-7XGX-C9VH RCE via ZipSlip and symbolic links in argoproj/argo-workflows

Summary The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. Details The untar code that handles symbolic links in archives is unsafe. Concretely, the computation of the link's target and the subsequent check are flawed:...

Argo Workflows 操作系统命令注入漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. An operating system command injection vulnerability exists in Argo Workflows versions 3.6.13 and earlier and versions 3.7.0 through 3.7.4, which stems from improper handling of symbolic links a...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: json-server, sqlpad, saf, thingsboard, argo-workflows, tileserver-gl...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: json-server, sqlpad, saf, thingsboard, argo-workflows, tileserver-gl...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: thingsboard, argo-workflows, saf, librechat, sqlpad, json-server, tileserver-gl, redisinsight...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: thingsboard, argo-workflows, saf, librechat, sqlpad, json-server, tileserver-gl, redisinsight...

Information Disclosure

github.com/argoproj/argo-workflows is vulnerable to Information Disclosure. The vulnerability is due to artifact repository credentials being logged in plaintext within the workflow-controller pod logs, which allows an attacker with permission to read pod logs to obtain these credentials and...

Directory Traversal

github.com/argoproj/argo-workflows is vulnerable to Directory Traversal. The vulnerability is due to improper validation of archive entry paths during artifact extraction, which allows an attacker to craft malicious archive files that write arbitrary files outside the intended extraction director...

SUSE CVE-2025-62156

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic...