Argo CD allows cross-site scripting on repositories page
Priority MEDIUM 42CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Fix Partial argo-cd (argoproj): 2.13.8, 2.14.13, 3.0.4github.com/argoproj/argo-cd/v2 (Go): 2.13.8, 2.14.13+1 more productRed Hat: 4 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| argoproj | argo-cd | 1.2.0-rc1 – 1.8.7; 2.0.0-rc3 to before 2.13.8; 2.14.0-rc1 to before 2.14.13; 3.0.0-rc1 to before 3.0.4 | 2.13.8, 2.14.13, 3.0.4 | Patch available | CNA |
| — | github.com/argoproj/argo-cd (Go) | 1.2.0-rc1 – 1.8.7 | — | No fix listed | GHSA-2hj5-g64g-fp6p |
| — | github.com/argoproj/argo-cd/v2 (Go) | 2.0.0-rc3 to before 2.13.8 | 2.13.8 | Patch available | GHSA-2hj5-g64g-fp6p |
| — | github.com/argoproj/argo-cd/v2 (Go) | 2.14.0-rc1 to before 2.14.13 | 2.14.13 | Patch available | GHSA-2hj5-g64g-fp6p |
| — | github.com/argoproj/argo-cd/v3 (Go) | before 3.0.4 | 3.0.4 | Patch available | GHSA-2hj5-g64g-fp6p |
- argo-cd Vendorargoproj Affected 1.2.0-rc1 – 1.8.7; 2.0.0-rc3 to before 2.13.8; 2.14.0-rc1 to before 2.14.13; 3.0.0-rc1 to before 3.0.4 Fixed in 2.13.8, 2.14.13, 3.0.4 Patch available CNA
- github.com/argoproj/argo-cd (Go) Vendor— Affected 1.2.0-rc1 – 1.8.7 Fixed in — No fix listed GHSA-2hj5-g64g-fp6p
- github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.0.0-rc3 to before 2.13.8 Fixed in 2.13.8 Patch available GHSA-2hj5-g64g-fp6p
- github.com/argoproj/argo-cd/v2 (Go) Vendor— Affected 2.14.0-rc1 to before 2.14.13 Fixed in 2.14.13 Patch available GHSA-2hj5-g64g-fp6p
- github.com/argoproj/argo-cd/v3 (Go) Vendor— Affected before 3.0.4 Fixed in 3.0.4 Patch available GHSA-2hj5-g64g-fp6p
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* | 1.2.1 to before 2.13.8; 2.14.0 to before 2.14.13; 3.0.0 to before 3.0.4 | Vulnerable | argoproj |
| cpe:2.3:a:argoproj:argo_cd:1.2.0:rc1:*:*:*:*:*:* | 1.2.0 rc1 | Vulnerable | argoproj |
| cpe:2.3:a:argoproj:argo_cd:1.2.0:rc2:*:*:*:*:*:* | 1.2.0 rc2 | Vulnerable | argoproj |
- cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions 1.2.1 to before 2.13.8; 2.14.0 to before 2.14.13; 3.0.0 to before 3.0.4 Vulnerable ·argoproj
- cpe:2.3:a:argoproj:argo_cd:1.2.0:rc1:*:*:*:*:*:* Versions 1.2.0 rc1 Vulnerable ·argoproj
- cpe:2.3:a:argoproj:argo_cd:1.2.0:rc2:*:*:*:*:*:* Versions 1.2.0 rc2 Vulnerable ·argoproj
Remediation
- Fix · CNA argo-cd (argoproj) Fixed in 2.13.8, 2.14.13, 3.0.4
- Fix · GHSA-2hj5-g64g-fp6p github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.13.8 Advisory →
- Fix · GHSA-2hj5-g64g-fp6p github.com/argoproj/argo-cd/v2 (Go) Fixed in 2.14.13 Advisory →
- Fix · GHSA-2hj5-g64g-fp6p github.com/argoproj/argo-cd/v3 (Go) Fixed in 3.0.4 Advisory →
Red Hat 4 advisories
- RHSA-2025:8278 Released 2025-05-28 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.16.1 security update
- Red Hat OpenShift GitOps 1.16 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
- RHSA-2025:8277 Released 2025-05-28 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.15.3 security update
- Red Hat OpenShift GitOps 1.15 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-extensions-rhel8, openshift-gitops-1/argocd-rhel8 +7
- RHSA-2025:8274 Released 2025-05-28 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.14.4 security update
- Red Hat OpenShift GitOps 1.14 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
Show 1 more Red Hat advisories
- RHSA-2025:8269 Released 2025-05-28 · Red Hat rating ImportantRed Hat OpenShift GitOps 1.16.1 security release
- Red Hat OpenShift GitOps 1.16 microshift-gitops-1.16.1-10.el9, microshift-gitops-release-info-1.16.1-10.el9, openshift-gitops-argocd-cli-1.16.1-10.el9 +3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift GitOps 1.14 | Fixed | RHSA-2025:8274 |
| Red Hat OpenShift GitOps 1.15 | Fixed | RHSA-2025:8277 |
| Red Hat OpenShift GitOps 1.16 | Fixed | RHSA-2025:8269, RHSA-2025:8278 |
Not affected: 4 products
- Multicluster Engine for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift GitOps
- Red Hat Openshift Data Foundation 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47933
- 2026-10-03 Alias added: GHSA-2hj5-g64g-fp6p
References
More argoproj Argo Cd vulnerabilities
- TI-2024-14377 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss CVSS 3.1CRITICAL 9.8
- TI-2024-14383 Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow CVSS 3.1CRITICAL 9.1
- TI-2026-31086 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction CVSS 3.1CRITICAL 9.6
- TI-2023-20919 Cluster secret might leak in cluster details page in Argo CD CVSS 3.1CRITICAL 9.9
- TI-2024-21088 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache CVSS 3.1CRITICAL 9.1
- TI-2026-33475 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation CVSS 3.1HIGH 8.7
Sources
- CVE-2025-47933 · CVE Program
- CVE-2025-47933 · NVD
- FIRST EPSS
- GHSA-2hj5-g64g-fp6p · GitHub Advisory Database · CC BY 4.0
- CVE-2025-47933 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences