CVE-2025-47933

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to v2.13.8 Argo CD versions prior to v2.14.13 Argo CD versions prior to v3.0.4

Description This issue allows an attacker to perform arbitrary actions on behalf of the victim via the API, such as creating, modifying, and deleting Kubernetes resources. The vulnerability is caused by the improper filtering of URL protocols in the repository page, allowing an attacker to achieve cross-site scripting with permission to edit the repository. The ui/src/app/shared/components/urls.ts file contains code that parses the repository URL without validating the protocol, making it possible to inject javascript: URLs. This can lead to cross-site scripting as the return value of this function is used in the href attribute of the a tag.

Recommendations Update to Argo CD version v2.13.8 or later to fix the vulnerability. Update to Argo CD version v2.14.13 or later to fix the vulnerability. Update to Argo CD version v3.0.4 or later to fix the vulnerability. As a temporary workaround, consider relying on the browser to filter the URL until a patch is applied.