Vulnerability · Published May 29, 2025 · Assigned by GitHub_M
CVE-2025-47933Argo CD allows cross-site scripting on repositories page
Critical 9.1
In plain English
A critical-severity cross-site scripting in argo-cd from argoproj. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/argoproj/argo-cd | no fix listed | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd | no fix listed | GO-2025-3720 |
| Go | github.com/argoproj/argo-cd/v2 | 2.13.8, 2.14.13 | GO-2025-3720 |
| Go | github.com/argoproj/argo-cd/v2 | 2.13.8 | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd/v2 | 2.14.13 | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd/v3 | 3.0.4 | GHSA-2hj5-g64g-fp6p |
| Go | github.com/argoproj/argo-cd/v3 | 3.0.4 | GO-2025-3720 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H