Cross-Site Scripting Vulnerability in Argo CD by Argo Project
CVE-2025-47933

9.1CRITICAL

Key Information:

Vendor

Argoproj

Status
Argo-cd
Vendor
CVE Published:
29 May 2025

What is CVE-2025-47933?

Argo CD, a GitOps continuous delivery tool for Kubernetes, is susceptible to a cross-site scripting vulnerability that allows attackers to perform arbitrary actions on behalf of victims through its API. The issue arises from inadequate filtering of URL protocols on the repository page, leading to potential exploitation if attackers can access repository editing permissions. This vulnerability has been resolved in versions 2.13.8, 2.14.13, and 3.0.4.

Affected Version(s)

argo-cd >= 1.2.0-rc1, <= 1.8.7 <= 1.2.0-rc1, 1.8.7

argo-cd >= 2.0.0-rc3, < 2.13.8 < 2.0.0-rc3, 2.13.8

argo-cd >= 2.14.0-rc1, < 2.14.13 < 2.14.0-rc1, 2.14.13

References

https://github.com/argoproj/argo-cd/security/advisories/G...
x_refsource_CONFIRM
https://github.com/argoproj/argo-cd/commit/a5b4041a79c54b...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-47933 : Cross-Site Scripting Vulnerability in Argo CD by Argo Project