logo

Database

Lack of data validation - Path Traversal In github.com/argoproj/argo-workflows

Description

RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows RCE via ZipSlip and symbolic links in argoproj/argo-workflows in github.com/argoproj/argo-workflows

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2025-666262. NVD-2025-666263. OSV-2025-666264. OSV-GO-2025-42235. GHSA-xrqc-7xgx-c9vh6. GHSA-p84v-gxvw-73pf7. GCVE-2025-666268. GHSA-xrqc-7xgx-c9vh

References

1. https://github.com/argoproj/argo-workflows/security/advisories/GHSA-xrqc-7xgx-c9vh2. https://github.com/argoproj/argo-workflows/commit/6b92af23f35aed4d4de8b04adcaf19d68f006de13. https://github.com/argoproj/argo-workflows/blob/5291e0b01f94ba864f96f795bb500f2cfc5ad799/workflow/executor/executor.go#L1034-L1037

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.