CVE-2026-59960: Improper Neutralization of Special Elements used in an OS Command

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUBHEADREF or ARGOSBRANCH can flow through config.branch and getMergeBaseCommitSha when hasRemoteContentAccess is false. The gitFetch and...

PT-2022-26173 · Sourcegraph · Sourcegraph

Name of the Vulnerable Software and Affected Versions: Sourcegraph versions prior to 4.1.0 Description: The issue allows a site admin to execute arbitrary commands on Gitserver when the experimental customGitFetch feature is enabled. This feature has been disabled by default. Recommendations: For...