GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd...

CVE-2025-47933

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

CVE-2025-47933

CVE-2025-47933 affects Argo CD (GitOps for Kubernetes). The issue is an XSS via the API caused by improper filtering of URL protocols on the repository page, enabling arbitrary actions on behalf of the victim when a user with edit permissions views a repository. It applies to versions before the ...

CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

GHSA-2HJ5-G64G-FP6P vulnerabilities

Vulnerabilities for packages: argo-cd, argocd-image-updater-fips, argocd-image-updater...

Cross-Site Scripting (XSS)

github.com/argoproj/argo-cd is vulnerable to cross-site scripting XSS. The vulnerability is due to improper URL protocol filtering on the repository page, allowing attackers to perform actions such as creating, modifying, and deleting Kubernetes resources via the API...

Argo CD 跨站脚本漏洞

Argo CD is an Argo open source declarative GitOps continuous delivery tool for Kubernetes. A cross-site scripting vulnerability exists in Argo CD 1.2.0-rc1 and earlier versions, which stems from insufficient URL protocol filtering and could lead to cross-site scripting attacks...

Argo CD allows cross-site scripting on repositories page

Impact This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with...

GHSA-2HJ5-G64G-FP6P Argo CD allows cross-site scripting on repositories page

Impact This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with...

argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)

A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps 1.16.1 security release

Errata advisory for Red Hat OpenShift GitOps 1.16.1 security release. The Red Hat OpenShift GitOps 1.16.1 release provides security updates to the Argo CD CLI, Argo Rollouts CLI and MicroShift GitOps. Security Fixes: openshift-gitops-1/argocd-rhel9: Improper URL Sanitization in Argo CD Repository...

Cross-site Scripting (XSS)

Overview github.com/argoproj/argo-cd/v2/ui is a declarative, GitOps continuous delivery tool for Kubernetes. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper filtering of repository URLs in the UI. An attacker can execute unauthorized API actions via th...

PT-2025-23137 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4 Description: This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, an...

RHEL 8 / 9 : Red Hat OpenShift GitOps 1.16.1 security (Important) (RHSA-2025:8269)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8269 advisory. The Red Hat OpenShift GitOps 1.16.1 release provides security updates to the Argo CD CLI, Argo Rollouts CLI and MicroShift GitOps. Security Fixes...

CVE-2024-52814

Argo Helm is a collection of community maintained charts for argoproj.github.io projects. Prior to version 0.45.0, the workflow-role lacks granularity in its privileges, giving permissions to workflowtasksets and workflowartifactgctasks to all workflow Pods, when only certain types of Pods create...

CVE-2024-52799

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

CVE-2024-32476

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service DoS vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in versions 2.10.7, 2.9.12 and 2.8.16...

CVE-2023-25163

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...