Command Injection Vulnerability in Argos JavaScript SDK Affects CI Runners
CVE-2026-59960

7.5HIGH

Key Information:

Vendor

Argos-ci

Status
Argos-javascript
Vendor
CVE Published:
14 September 2026

What is CVE-2026-59960?

A command injection vulnerability has been identified in the Argos JavaScript SDK, allowing attacker-controlled branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH to be executed in the CI environment. This occurs when hasRemoteContentAccess is set to false, allowing values to be interpolated into execSync() command strings executed by /bin/sh -c. Attackers can exploit this vulnerability to execute arbitrary commands during the Argos upload process, potentially exposing CI secrets, altering build artifacts, or compromising the CI runner. The vulnerability has been addressed in Argos core package version 6.2.1.

Affected Version(s)

argos-javascript < 6.2.1

References

https://github.com/argos-ci/argos-javascript/security/adv...
x_refsource_CONFIRM
https://github.com/argos-ci/argos-javascript/pull/319
x_refsource_MISC
https://github.com/argos-ci/argos-javascript/commit/8355f...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.