github.com/argoproj/argo-cd/v3
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- 22 advisory(ies) without a verdict
Advisories (22)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2hj5-g64g-fp6p Argo CD allows cross-site scripting on repositories page | < 3.0.4 | Undetermined |
| GHSA-3v3m-wc6v-x4x3 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | 3.2.0 – < 3.2.11 ; 3.3.0 – < 3.3.9 | Undetermined |
| GHSA-786q-9hcg-v9ff Argo CD's Project API Token Exposes Repository Credentials | < 3.0.14 ; 3.1.0-rc1 – < 3.1.2 | Undetermined |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | 3.2.0-rc1 – < 3.2.0-rc2 ; 3.1.0-rc1 – < 3.1.8 ; 3.0.0-rc1 – < 3.0.19 | Undetermined |
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | 3.0.0 – < 3.3.15 ; 3.4.0 – < 3.4.10 ; 3.5.0 – < 3.5.4 ; … | Undetermined |
| GHSA-g88p-r42r-ppp9 Repository Credentials Race Condition Crashes Argo CD Server | 3.2.0-rc1 – < 3.2.0-rc2 ; 3.1.0-rc1 – < 3.1.8 ; 3.0.0-rc1 – < 3.0.19 | Undetermined |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | 3.2.0-rc1 – < 3.2.0-rc2 ; 3.1.0-rc1 – < 3.1.8 ; 3.0.0-rc1 – < 3.0.19 | Undetermined |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | < 3.2.12 ; 3.3.0-rc1 – < 3.3.10 ; 3.4.0-rc1 – < 3.4.2 | Undetermined |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | 3.0.0 – < 3.3.15 ; 3.4.0 – < 3.4.10 ; 3.5.0 – < 3.5.4 ; … | Undetermined |
| GHSA-rg3g-4rw9-gqrp Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations | 3.2.0 – < 3.2.12 ; 3.3.0-rc1 – < 3.3.10 ; 3.4.0-rc1 – < 3.4.2 | Undetermined |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | 3.2.0-rc1 – < 3.2.0-rc2 ; 3.1.0-rc1 – < 3.1.8 ; 3.0.0-rc1 – < 3.0.19 | Undetermined |
| GO-2025-3720 Argo CD allows cross-site scripting on repositories page in github.com/argoproj/argo-cd | < 3.0.4 | Undetermined |
| GO-2025-3934 Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd | < 3.0.14 ; 3.1.0-rc1 – < 3.1.2 | Undetermined |
| GO-2025-3993 Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload in github.com/argoproj/argo-cd | 3.0.0-rc1 – < 3.0.19 ; 3.1.0-rc1 – < 3.1.8 ; 3.2.0-rc1 – < 3.2.0-rc2 | Undetermined |
| GO-2025-3994 Repository Credentials Race Condition Crashes Argo CD Server in github.com/argoproj/argo-cd | 3.0.0-rc1 – < 3.0.19 ; 3.1.0-rc1 – < 3.1.8 ; 3.2.0-rc1 – < 3.2.0-rc2 | Undetermined |
| GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd | 3.0.0-rc1 – < 3.0.19 ; 3.1.0-rc1 – < 3.1.8 ; 3.2.0-rc1 – < 3.2.0-rc2 | Undetermined |
| GO-2025-3996 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload in github.com/argoproj/argo-cd | 3.0.0-rc1 – < 3.0.19 ; 3.1.0-rc1 – < 3.1.8 ; 3.2.0-rc1 – < 3.2.0-rc2 | Undetermined |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd | 3.2.0 – < 3.2.11 ; 3.3.0 – < 3.3.9 | Undetermined |
| GO-2026-5418 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation in github.com/argoproj/argo-cd | < 3.2.12 ; 3.3.0-rc1 – < 3.3.10 ; 3.4.0-rc1 – < 3.4.2 | Undetermined |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations in github.com/argoproj/argo-cd | 3.2.0 – < 3.2.12 ; 3.3.0-rc1 – < 3.3.10 ; 3.4.0-rc1 – < 3.4.2 | Undetermined |
| GO-2026-6701 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL in github.com/argoproj/argo-cd | 3.0.0 – < 3.3.15 ; 3.4.0 – < 3.4.10 ; 3.5.0 – < 3.5.4 ; … | Undetermined |
| GO-2026-6784 Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks in github.com/argoproj/argo-cd | 3.0.0 – < 3.3.15 ; 3.4.0 – < 3.4.10 ; 3.5.0 – < 3.5.4 ; … | Undetermined |
Sources
| Source | Licence |
|---|