Critical severity9.0NVD Advisory· Published May 29, 2025· Updated Jun 17, 2026
CVE-2025-47933
CVE-2025-47933
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/argoproj/argo-cdGo | >= 1.2.0-rc1, <= 1.8.7 | — |
github.com/argoproj/argo-cd/v2Go | >= 2.0.0-rc3, < 2.13.8 | 2.13.8 |
github.com/argoproj/argo-cd/v2Go | >= 2.14.0-rc1, < 2.14.13 | 2.14.13 |
github.com/argoproj/argo-cd/v3Go | < 3.0.4 | 3.0.4 |
Affected products
20- osv-coords16 versionspkg:apk/chainguard/argo-cd-2.14pkg:apk/chainguard/argo-cd-2.14-compatpkg:apk/chainguard/argo-cd-2.14-repo-serverpkg:apk/chainguard/argocd-image-updaterpkg:apk/chainguard/argocd-image-updater-compatpkg:apk/chainguard/argocd-image-updater-fipspkg:apk/wolfi/argo-cd-2.14pkg:apk/wolfi/argo-cd-2.14-compatpkg:apk/wolfi/argo-cd-2.14-repo-serverpkg:apk/wolfi/argocd-image-updaterpkg:apk/wolfi/argocd-image-updater-compatpkg:bitnami/argo-cdpkg:golang/github.com/argoproj/argo-cdpkg:golang/github.com/argoproj/argo-cd/v2pkg:golang/github.com/argoproj/argo-cd/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 2.14.13-r0+ 15 more
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r4
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: >= 1.2.0, < 2.13.8
- (no CPE)range: >= 1.2.0-rc1, <= 1.8.7
- (no CPE)range: >= 2.0.0-rc3, < 2.13.8
- (no CPE)range: < 3.0.4
- (no CPE)range: < 0.0.20250529T205903-1.1
Patches
Vulnerability mechanics
References
4- github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1nvdPatchWEB
- github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6pnvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-2hj5-g64g-fp6pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-47933ghsaADVISORY
News mentions
0No linked articles in our index yet.