CVE-2025-47933Critical· 9.0▾ MidnightArgo CD allows cross-site scripting on repositories page
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 49.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository.
In ui/src/app/shared/components/urls.ts, the following code exists to parse the repository URL.
Since this code doesn't validate the protocol of repository URLs, it's possible to inject javascript: URLs here.
As the return value of this function is used in the href attribute of the a tag, it's possible to achieve cross-site scripting by using javascript: URLs.
Browsers may return the proper hostname for javascript: URLs, allowing exploitation of this vulnerability.
A patch for this vulnerability has been released in the following Argo CD versions:
The patch incorporates a way to validate the URL being passed in. Returning null if the validation fails.
There are no workarounds other than depending on the browser to filter the URL.
Disclosed by @Ry0taK RyotaK.
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
github.com/argoproj/argo-cd >= 1.2.0-rc1, <= 1.8.7github.com/argoproj/argo-cd/v2 >= 2.0.0-rc3, < 2.13.8github.com/argoproj/argo-cd/v2 >= 2.14.0-rc1, < 2.14.13github.com/argoproj/argo-cd/v3 < 3.0.4Upgrade to a patched release:
github.com/argoproj/argo-cd/v2 2.13.8github.com/argoproj/argo-cd/v2 2.14.13github.com/argoproj/argo-cd/v3 3.0.4Connected by shared product, vendor, weakness, or advisory.
CVE-2024-21661High· 7.5Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment
CVE-2023-40026Medium· 5.0Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server
CVE-2023-23947Critical· 9.1Users with any cluster secret update access may update out-of-bounds cluster secrets
CVE-2024-36106Medium· 4.3Argo-cd authenticated users can enumerate clusters by name
CVE-2024-28175Critical· 9.0Cross-site scripting on application summary component
CVE-2023-50726Medium· 6.4Users with `create` but not `override` privileges can perform local sync