logo

Database

Server side cross-site scripting In github.com/argoproj/argo-workflows/v2

Description

Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows Argo Workflows affected by stored XSS in the artifact directory listing in github.com/argoproj/argo-workflows

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2026-239602. NVD-2026-239603. OSV-GO-2026-43504. OSV-2026-239605. GHSA-cv78-6m8q-ph826. GCVE-2026-239607. GHSA-cv78-6m8q-ph82

References

1. https://github.com/argoproj/argo-workflows/commit/159a5c56285ecd4d3bb0a67aeef4507779a44e172. https://github.com/argoproj/argo-workflows/blob/9872c296d29dcc5e9c78493054961ede9fc30797/server/artifacts/artifact_server.go#L194-L2443. https://github.com/argoproj/argo-workflows/releases/tag/v3.6.174. https://github.com/argoproj/argo-workflows/releases/tag/v3.7.85. https://github.com/argoproj/argo-workflows/security/advisories/GHSA-cv78-6m8q-ph82

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.