VYPR
Get started
← All advisories
Critical severityNVD Advisory· Published May 29, 2025· Updated May 30, 2025

Argo CD allows cross-site scripting on repositories page

CVE-2025-47933

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/argoproj/argo-cdGo
>= 1.2.0-rc1, <= 1.8.7—
github.com/argoproj/argo-cd/v2Go
>= 2.0.0-rc3, < 2.13.82.13.8
github.com/argoproj/argo-cd/v2Go
>= 2.14.0-rc1, < 2.14.132.14.13
github.com/argoproj/argo-cd/v3Go
< 3.0.43.0.4

Affected products

1

Patches

1
a5b4041a79c5

Merge commit from fork

https://github.com/argoproj/argo-cdRyotaKMay 28, 2025via ghsa
commit
1 file changed · +6 −1
  • ui/src/app/shared/components/urls.ts+6 −1 modified
    @@ -1,5 +1,6 @@
 import {GitUrl} from 'git-url-parse';
 import {isSHA} from './revision';
+import {isValidURL} from '../../shared/utils';
 
 const GitUrlParse = require('git-url-parse');
 
@@ -19,7 +20,11 @@ export function repoUrl(url: string): string {
             return null;
         }
 
-        return `${protocol(parsed.protocol)}://${parsed.resource}/${parsed.owner}/${parsed.name}`;
+        const parsedUrl = `${protocol(parsed.protocol)}://${parsed.resource}/${parsed.owner}/${parsed.name}`;
+        if (!isValidURL(parsedUrl)) {
+            return null;
+        }
+        return parsedUrl;
     } catch {
         return null;
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.