What’s Vulnerable › Vulnerabilities

CVE-2025-47933: Argo CD allows cross-site scripting on repositories page

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-29 · updated 2026-06-17
• Weakness: CWE-79

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve cross-site scripting with permission to edit the repository. This issue has been patched in versions 2.13.8, 2.14.13, and 3.0.4.

Affected products

• argoproj argo-cd: from 1.2.1 before 2.13.8; from 2.14.0 before 2.14.13; from 3.0.0 before 3.0.4; 1.2.0-rc1, 1.2.0-rc2 — fixed in 2.13.8, 2.14.13, 3.0.4

How to fix

Upgrade to a fixed version: argoproj argo-cd 2.13.8, 2.14.13, 3.0.4. Check the vendor advisory for mitigations.

References

• https://github.com/argoproj/argo-cd/commit/a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-2hj5-g64g-fp6p

Get alerted when CVE-2025-47933 or the next vulnerability affects your stack