Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered by ui/src/app/applications/components/application-summary/application-summary.tsx in the Summary tab URLs section as anchor href values without URL validation, allowing javascript: execution in a higher-privileged user's authenticated Argo CD origin session. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
argoproj argo-cd
< 3.2.12affected>= 3.3.0, < 3.3.10affected>= 3.4.0-rc1, < 3.4.2affected
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-h98r-wv3h-fr38 ↗
- https://github.com/argoproj/argo-cd/commit/00f83c41dcfd879f34f8e0248c860d704b41cf0f ↗
- https://github.com/argoproj/argo-cd/commit/35ea43c537d6e8948e67f347317fc4f88b325122 ↗
- https://github.com/argoproj/argo-cd/commit/c8df5ff7acc403adcee1256da5d87081cd52f0a6 ↗
- https://github.com/argoproj/argo-cd/releases/tag/v3.2.12 ↗
- https://github.com/argoproj/argo-cd/releases/tag/v3.3.10 ↗
- https://github.com/argoproj/argo-cd/releases/tag/v3.4.2 ↗