Every CVE Search/ Get API key

CVE-2025-47933

Argo CD allows cross-site scripting on repositories page

9.1 CriticalFix available

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.49%Up 0.4 points since May 30, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.1

Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Record
CVE-2025-47933
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2025-16408 9.1

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Record
EUVD-2025-16408
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2hj5-g64g-fp6p 9.0

Argo CD allows cross-site scripting on repositories page

Impact

This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository.

In ui/src/app/shared/components/urls.ts, the following code exists to parse the repository URL.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/urls.ts#L14-L26

Since this code doesn't validate the protocol of repository URLs, it's possible to inject javascript: URLs here.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/repo.tsx#L5-L7

As the return value of this function is used in the href attribute of the a tag, it's possible to achieve cross-site scripting by using javascript: URLs.

Browsers may return the proper hostname for javascript: URLs, allowing exploitation of this vulnerability.

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

  • v3.0.4
  • v2.14.13
  • v2.13.8

The patch incorporates a way to validate the URL being passed in. Returning null if the validation fails.

Workarounds

There are no workarounds other than depending on the browser to filter the URL.

Credits

Disclosed by @Ry0taK RyotaK.

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Record
GHSA-2hj5-g64g-fp6p
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
NVD 9.0

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Record
CVE-2025-47933
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 9.0

Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Record
CVE-2025-47933
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-2hj5-g64g-fp6p 9.0

Argo CD allows cross-site scripting on repositories page

Impact

This vulnerability allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository.

In ui/src/app/shared/components/urls.ts, the following code exists to parse the repository URL.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/urls.ts#L14-L26

Since this code doesn't validate the protocol of repository URLs, it's possible to inject javascript: URLs here.

https://github.com/argoproj/argo-cd/blob/0ae5882d5ae9fe88efc51f65ca8543fb8c3a0aa1/ui/src/app/shared/components/repo.tsx#L5-L7

As the return value of this function is used in the href attribute of the a tag, it's possible to achieve cross-site scripting by using javascript: URLs.

Browsers may return the proper hostname for javascript: URLs, allowing exploitation of this vulnerability.

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

  • v3.0.4
  • v2.14.13
  • v2.13.8

The patch incorporates a way to validate the URL being passed in. Returning null if the validation fails.

Workarounds

There are no workarounds other than depending on the browser to filter the URL.

Credits

Disclosed by @Ry0taK RyotaK.

For more information

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Record
GHSA-2hj5-g64g-fp6p
CVSS 3.1
9.0 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weakness
CWE-79
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2025:8269 8.2

Red Hat Security Advisory: Red Hat OpenShift GitOps 1.16.1 security release

Record
RHSA-2025:8269
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L
Updated
2026-11-02
OSVBIT-argo-cd-2025-47933 No score

Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Record
BIT-argo-cd-2025-47933
Updated
2026-11-02
OSVGO-2025-3720 No score

Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd

Record
GO-2025-3720
Updated
2026-11-02
OSVopenSUSE-SU-2025:15188-1 No score

govulncheck-vulndb-0.0.20250529T205903-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250529T205903-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15188-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/argoproj/argo-cd
Go
 1.2.0-rc1 to 1.8.7 None known
github.com/argoproj/argo-cd/v2
Go
 2.0.0-rc3 up to 2.13.8
2.13.8
github.com/argoproj/argo-cd/v2
Go
 2.14.0-rc1 up to 2.14.13
2.14.13
github.com/argoproj/argo-cd/v3
Go
 before 3.0.4
3.0.4
argo-cd
Bitnami
 1.2.0 up to 2.13.8, 2.14.0 up to 2.14.13, 3.0.0 up to 3.0.4
2.13.82.14.133.0.4
github.com/argoproj/argo-cd
Go
 1.2.0-rc1 and later None known
github.com/argoproj/argo-cd/v2
Go
 2.0.0-rc3 up to 2.13.8, 2.14.0-rc1 up to 2.14.13
2.13.82.14.13
openshift-gitops-argocd-cli
Red Hat:openshift_gitops:1.16::el8
 before 0:1.16.1-26.el8
0:1.16.1-26.el8
openshift-gitops-argocd-cli-redistributable
Red Hat:openshift_gitops:1.16::el8
 before 0:1.16.1-26.el8
0:1.16.1-26.el8
microshift-gitops
Red Hat:openshift_gitops:1.16::el9
 before 0:1.16.1-10.el9
0:1.16.1-10.el9
Show 4 moreShow less
Affected packages
PackageAffectedFixed
microshift-gitops-release-info
Red Hat:openshift_gitops:1.16::el9
 before 0:1.16.1-10.el9
0:1.16.1-10.el9
openshift-gitops-argocd-cli
Red Hat:openshift_gitops:1.16::el9
 before 0:1.16.1-10.el9
0:1.16.1-10.el9
openshift-gitops-argocd-cli-redistributable
Red Hat:openshift_gitops:1.16::el9
 before 0:1.16.1-10.el9
0:1.16.1-10.el9
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.0.20250529T205903-1.1
0.0.20250529T205903-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47933 is a critical vulnerability (CVSS 9.1) in Argoproj Argo Cd, published May 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in github.com/argoproj/argo-cd/v2 2.13.8.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open