CVE-2026-45738

Katalog CVE

CVSS 8.7 · High EPSS 0,61%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada argoproj argo cd. Skor CVSS 3.1 8.7 (High) menurut NVD.

Deskripsi (NVD)

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38 exploit · advisory vendor
• https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f patch
• https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122 patch
• https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6 patch
• https://github.com/argoproj/argo-cd/releases/tag/v3.2.12 release notes
• https://github.com/argoproj/argo-cd/releases/tag/v3.3.10 release notes
• https://github.com/argoproj/argo-cd/releases/tag/v3.4.2 release notes