Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| argoproj | argo-cd | >= 1.2.0-rc1, <= 1.8.7, >= 2.0.0-rc3, < 2.13.8, >= 2.14.0-rc1, < 2.14.13, >= 3.0.0-rc1, < 3.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Gitops 1 | microshift-gitops +3 | 1.16.1-10.el9 | RHSA-2025:8269 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250529T205903-1.1 | openSUSE-SU-2025:15188-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argocd-image-updater +1 | 0.16.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/argoproj/argo-cd | >= 1.2.0-rc1, <= 1.8.7 | — | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd | >= 1.2.0-rc1 | — | GO-2025-3720 |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.0.0-rc3, < 2.13.8 | 2.13.8 | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.14.0-rc1, < 2.14.13 | 2.14.13 | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd/v2 | >= 2.0.0-rc3, < 2.13.8 · >= 2.14.0-rc1, < 2.14.13 | 2.13.8, 2.14.13 | GO-2025-3720 |
| Go | github.com/argoproj/argo-cd/v3 | < 3.0.4 | 3.0.4 | GHSA-2hj5-g64g-fp6p |
Advisories 3
- RHSA-2025:8269 Red Hat Security Advisory: Red Hat OpenShift GitOps 1.16.1 security release Red Hat Security Advisories (RHSA) · Apr 30, 2026
- openSUSE-SU-2025:15188-1 govulncheck-vulndb-0.0.20250529T205903-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1164 Red Hat OpenShift GitOps: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Jun 2, 2025