Critical severityNVD Advisory· Published May 29, 2025· Updated May 30, 2025
Argo CD allows cross-site scripting on repositories page
CVE-2025-47933
Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/argoproj/argo-cdGo | >= 1.2.0-rc1, <= 1.8.7 | — |
github.com/argoproj/argo-cd/v2Go | >= 2.0.0-rc3, < 2.13.8 | 2.13.8 |
github.com/argoproj/argo-cd/v2Go | >= 2.14.0-rc1, < 2.14.13 | 2.14.13 |
github.com/argoproj/argo-cd/v3Go | < 3.0.4 | 3.0.4 |
Affected products
17- osv-coords16 versionspkg:apk/chainguard/argo-cd-2.14pkg:apk/chainguard/argo-cd-2.14-compatpkg:apk/chainguard/argo-cd-2.14-repo-serverpkg:apk/chainguard/argocd-image-updaterpkg:apk/chainguard/argocd-image-updater-compatpkg:apk/chainguard/argocd-image-updater-fipspkg:apk/wolfi/argo-cd-2.14pkg:apk/wolfi/argo-cd-2.14-compatpkg:apk/wolfi/argo-cd-2.14-repo-serverpkg:apk/wolfi/argocd-image-updaterpkg:apk/wolfi/argocd-image-updater-compatpkg:bitnami/argo-cdpkg:golang/github.com/argoproj/argo-cdpkg:golang/github.com/argoproj/argo-cd/v2pkg:golang/github.com/argoproj/argo-cd/v3pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 2.14.13-r0+ 15 more
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r4
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 2.14.13-r0
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: < 0.16.0-r3
- (no CPE)range: >= 1.2.0, < 2.13.8
- (no CPE)range: >= 1.2.0-rc1, <= 1.8.7
- (no CPE)range: >= 2.0.0-rc3, < 2.13.8
- (no CPE)range: < 3.0.4
- (no CPE)range: < 0.0.20250529T205903-1.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-2hj5-g64g-fp6pghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-47933ghsaADVISORY
- github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1ghsax_refsource_MISCWEB
- github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6pghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.