Critical XSS vulnerability in Argo CD exposes Kubernetes clusters to full resource manipulation
Take action: Exploiting this flaw requires that an authenticated user, so you have a bit of time to prepare for an update. But bear in mind that user credentials can be hacked, and there is always a chance of a malicious insider. So don't ignore this flaw, plan a patch.
Learn More
A critical cross-site scripting (XSS) vulnerability has been discovered in Argo CD, a widely used open-source GitOps tool for Kubernetes deployment and management.
The flaw is tracked as CVE-2025-47933 (CVSS score 9.9) and affects the repository URL handling mechanism in the Argo CD user interface, targeting the URL protocol validation system within the ui/src/app/shared/components/urls.ts file. The vulnerability allows attackers with repository editing permissions to inject malicious JavaScript URLs that execute within the browser context of authenticated users.
When processing repository URLs, the vulnerable code fails to validate or restrict URL protocols, allowing malicious actors to inject javascript: schemes that are subsequently rendered as clickable links in the user interface. When legitimate users interact with these compromised links, the embedded JavaScript code executes within their authenticated browser session.
Affected versions include all Argo CD releases from version 1.2.0-rc1 onwards. The vulnerability has been present in the codebase for an extended period, affecting both community and enterprise deployments across different organizations and cloud environments.
Patched versions are Argo CD versions 2.13.8, 2.14.13, and 3.0.4.
The attack vector requires an authenticated user with repository editing permissions to modify repository settings and inject malicious URL schemes.
Organizations using affected Argo CD versions should upgrade to the latest patched releases: version 2.13.8, 2.14.13, or 3.0.4.
