CVE-2025-47933

Published: May 29, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Affected (5)

Products: Argoproj: Argo Cd

Argoproj

1 product

Argo Cd

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Argoproj Argo Cd	From 1.2.1 to 2.13.8
Argoproj Argo Cd	From 2.14.0 to 2.14.13
Argoproj Argo Cd	From 3.0.0 to 3.0.4
Argoproj Argo Cd	Version 1.2.0 rc1
Argoproj Argo Cd	Version 1.2.0 rc2

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1

Source: security-advisories@github.com

Patch

https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p

Source: security-advisories@github.com

PatchThird Party Advisory

Timeline

No history available yet.